Init
This commit is contained in:
mguschin
616
DEPLOYMENT.md
Normal file
616
DEPLOYMENT.md
Normal file
@@ -0,0 +1,616 @@
|
||||
# Deployment Guide
|
||||
|
||||
This guide walks you through deploying the VPN network on your actual servers.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- SSH access to both VDS servers
|
||||
- Root or sudo privileges
|
||||
- Basic familiarity with Linux command line
|
||||
|
||||
## Infrastructure
|
||||
|
||||
| Server | IP | Role |
|
||||
|--------|-----|------|
|
||||
| DE VDS | 194.31.173.178 | Exit node (Debian 13) |
|
||||
| RU VDS | 176.124.216.197 | Gateway (Debian 12) |
|
||||
|
||||
---
|
||||
|
||||
## Step 1: Deploy DE VDS (Exit Node)
|
||||
|
||||
### 1.1 Copy setup script to DE VDS
|
||||
|
||||
From your local machine:
|
||||
|
||||
```bash
|
||||
scp scripts/setup-de-vds.sh root@194.31.173.178:/root/
|
||||
```
|
||||
|
||||
### 1.2 Run setup script
|
||||
|
||||
SSH into DE VDS:
|
||||
|
||||
```bash
|
||||
ssh root@194.31.173.178
|
||||
```
|
||||
|
||||
Run the setup:
|
||||
|
||||
```bash
|
||||
cd /root
|
||||
chmod +x setup-de-vds.sh
|
||||
./setup-de-vds.sh
|
||||
```
|
||||
|
||||
### 1.3 Save the DE VDS public key
|
||||
|
||||
The script will output the DE VDS public key. **Copy it** - you'll need it for RU VDS.
|
||||
|
||||
Example output:
|
||||
```
|
||||
Your DE VDS public key is:
|
||||
Xabc123def456ghi789jkl012mno345pqr678stu901vwx234=
|
||||
```
|
||||
|
||||
**Do not start services yet** - we need to exchange keys first.
|
||||
|
||||
---
|
||||
|
||||
## Step 2: Deploy RU VDS (Gateway)
|
||||
|
||||
### 2.1 Copy setup script to RU VDS
|
||||
|
||||
From your local machine:
|
||||
|
||||
```bash
|
||||
scp scripts/setup-ru-vds.sh root@176.124.216.197:/root/
|
||||
```
|
||||
|
||||
### 2.2 Run setup script
|
||||
|
||||
SSH into RU VDS:
|
||||
|
||||
```bash
|
||||
ssh root@176.124.216.197
|
||||
```
|
||||
|
||||
Run the setup:
|
||||
|
||||
```bash
|
||||
cd /root
|
||||
chmod +x setup-ru-vds.sh
|
||||
./setup-ru-vds.sh
|
||||
```
|
||||
|
||||
### 2.3 Save the RU VDS keys
|
||||
|
||||
The script will output two public keys:
|
||||
|
||||
1. **Server key** - for clients (you'll use this later when adding clients)
|
||||
2. **DE tunnel key** - for DE VDS
|
||||
|
||||
Example output:
|
||||
```
|
||||
Server key (for clients):
|
||||
Yabc123def456ghi789jkl012mno345pqr678stu901vwx234=
|
||||
|
||||
DE tunnel key (for DE VDS):
|
||||
Zabc123def456ghi789jkl012mno345pqr678stu901vwx234=
|
||||
```
|
||||
|
||||
**Copy both keys** and keep them safe.
|
||||
|
||||
**Do not start services yet** - we need to configure keys first.
|
||||
|
||||
---
|
||||
|
||||
## Step 3: Exchange Keys
|
||||
|
||||
### 3.1 Configure DE VDS with RU key
|
||||
|
||||
SSH into DE VDS:
|
||||
|
||||
```bash
|
||||
ssh root@194.31.173.178
|
||||
```
|
||||
|
||||
Edit WireGuard config:
|
||||
|
||||
```bash
|
||||
nano /etc/wireguard/wg0.conf
|
||||
```
|
||||
|
||||
Replace `__RU_DE_TUNNEL_PUBLIC_KEY__` with the **RU DE tunnel key** (the second key from RU VDS).
|
||||
|
||||
Save and exit (Ctrl+X, Y, Enter).
|
||||
|
||||
### 3.2 Configure RU VDS with DE key
|
||||
|
||||
SSH into RU VDS:
|
||||
|
||||
```bash
|
||||
ssh root@176.124.216.197
|
||||
```
|
||||
|
||||
Edit WireGuard config:
|
||||
|
||||
```bash
|
||||
nano /etc/wireguard/wg1.conf
|
||||
```
|
||||
|
||||
Replace `__DE_SERVER_PUBLIC_KEY__` with the **DE VDS public key**.
|
||||
|
||||
Save and exit (Ctrl+X, Y, Enter).
|
||||
|
||||
---
|
||||
|
||||
## Step 4: Start Services
|
||||
|
||||
### 4.1 Start DE VDS services
|
||||
|
||||
SSH into DE VDS:
|
||||
|
||||
```bash
|
||||
ssh root@194.31.173.178
|
||||
```
|
||||
|
||||
Start services:
|
||||
|
||||
```bash
|
||||
systemctl start nftables
|
||||
systemctl start wg-quick@wg0
|
||||
```
|
||||
|
||||
Check status:
|
||||
|
||||
```bash
|
||||
systemctl status wg-quick@wg0
|
||||
wg show
|
||||
```
|
||||
|
||||
You should see:
|
||||
- `wg0` interface with IP `10.20.0.2/30`
|
||||
- No handshake yet (RU VDS not connected)
|
||||
|
||||
### 4.2 Start RU VDS services
|
||||
|
||||
SSH into RU VDS:
|
||||
|
||||
```bash
|
||||
ssh root@176.124.216.197
|
||||
```
|
||||
|
||||
Start services:
|
||||
|
||||
```bash
|
||||
systemctl start dnsmasq
|
||||
systemctl start wg-quick@wg1
|
||||
systemctl start wg-quick@wg0
|
||||
```
|
||||
|
||||
Check status:
|
||||
|
||||
```bash
|
||||
systemctl status wg-quick@wg1
|
||||
systemctl status wg-quick@wg0
|
||||
systemctl status dnsmasq
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 5: Verify Tunnel
|
||||
|
||||
### 5.1 Test from RU VDS
|
||||
|
||||
```bash
|
||||
# Ping DE VDS through tunnel
|
||||
ping -c 4 10.20.0.2
|
||||
|
||||
# Check WireGuard handshake
|
||||
wg show wg1
|
||||
```
|
||||
|
||||
You should see:
|
||||
- Successful ping responses
|
||||
- Recent handshake timestamp
|
||||
- Transfer data counters
|
||||
|
||||
### 5.2 Test from DE VDS
|
||||
|
||||
```bash
|
||||
# Check WireGuard handshake
|
||||
wg show wg0
|
||||
|
||||
# You should see recent handshake from RU VDS
|
||||
```
|
||||
|
||||
### 5.3 Check routing on RU VDS
|
||||
|
||||
```bash
|
||||
# Check routing table
|
||||
ip route show table proxy
|
||||
|
||||
# Check ipset
|
||||
ipset list direct
|
||||
|
||||
# Check policy routing rules
|
||||
ip rule show
|
||||
```
|
||||
|
||||
Expected output:
|
||||
- Routing table `proxy` should have default route via `10.20.0.2`
|
||||
- ipset `direct` should exist (empty initially)
|
||||
- Policy routing rule for `10.10.0.0/24` with fwmark `0x1`
|
||||
|
||||
---
|
||||
|
||||
## Step 6: Add First Client
|
||||
|
||||
### 6.1 Copy client management scripts to RU VDS
|
||||
|
||||
From your local machine:
|
||||
|
||||
```bash
|
||||
scp scripts/add-client.sh root@176.124.216.197:/root/
|
||||
scp scripts/list-clients.sh root@176.124.216.197:/root/
|
||||
scp scripts/disable-client.sh root@176.124.216.197:/root/
|
||||
scp scripts/enable-client.sh root@176.124.216.197:/root/
|
||||
scp scripts/remove-client.sh root@176.124.216.197:/root/
|
||||
```
|
||||
|
||||
### 6.2 Add a client
|
||||
|
||||
SSH into RU VDS:
|
||||
|
||||
```bash
|
||||
ssh root@176.124.216.197
|
||||
```
|
||||
|
||||
Add client (replace "phone" with your device name):
|
||||
|
||||
```bash
|
||||
chmod +x /root/*.sh
|
||||
/root/add-client.sh phone
|
||||
```
|
||||
|
||||
The script will:
|
||||
1. Generate client keys
|
||||
2. Assign IP address (starting from 10.10.0.2)
|
||||
3. Add peer to WireGuard
|
||||
4. Create client config file
|
||||
5. Display QR code for mobile devices
|
||||
|
||||
### 6.3 Transfer configuration to client
|
||||
|
||||
**For mobile devices:**
|
||||
- Scan the QR code with WireGuard app
|
||||
|
||||
**For desktop/laptop:**
|
||||
- Copy the configuration file from RU VDS:
|
||||
```bash
|
||||
cat /etc/wireguard/clients/phone.conf
|
||||
```
|
||||
- Save it locally as `phone.conf`
|
||||
- Import into WireGuard client
|
||||
|
||||
---
|
||||
|
||||
## Step 7: Test Client Connection
|
||||
|
||||
### 7.1 Connect from client
|
||||
|
||||
1. Open WireGuard app/client
|
||||
2. Import/scan the configuration
|
||||
3. Connect
|
||||
|
||||
### 7.2 Test basic connectivity
|
||||
|
||||
From the client device:
|
||||
|
||||
```bash
|
||||
# Test VPN gateway
|
||||
ping 10.10.0.1
|
||||
|
||||
# Test DNS
|
||||
nslookup google.com
|
||||
nslookup yandex.ru
|
||||
```
|
||||
|
||||
### 7.3 Test routing
|
||||
|
||||
From the client device:
|
||||
|
||||
```bash
|
||||
# Check external IP (should show DE VDS IP: 194.31.173.178)
|
||||
curl ifconfig.me
|
||||
|
||||
# Visit a Russian site, then check ipset on RU VDS
|
||||
```
|
||||
|
||||
On RU VDS:
|
||||
|
||||
```bash
|
||||
# After client visits .ru domains, check direct ipset
|
||||
ipset list direct
|
||||
|
||||
# Should show Russian IPs
|
||||
```
|
||||
|
||||
### 7.4 Advanced testing
|
||||
|
||||
Test that `.ru` domains go direct:
|
||||
|
||||
```bash
|
||||
# From client - visit some Russian sites
|
||||
curl -I https://yandex.ru
|
||||
curl -I https://mail.ru
|
||||
|
||||
# Then on RU VDS - check ipset
|
||||
ipset list direct
|
||||
```
|
||||
|
||||
Test that other domains go through DE:
|
||||
|
||||
```bash
|
||||
# From client
|
||||
traceroute google.com
|
||||
# Should show hop through 10.20.0.x
|
||||
|
||||
traceroute yandex.ru
|
||||
# Should NOT show 10.20.0.x hop (goes direct)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 8: Client Management
|
||||
|
||||
### List all clients
|
||||
|
||||
```bash
|
||||
/root/list-clients.sh
|
||||
```
|
||||
|
||||
### Add another client
|
||||
|
||||
```bash
|
||||
/root/add-client.sh laptop
|
||||
```
|
||||
|
||||
### Disable a client temporarily
|
||||
|
||||
```bash
|
||||
/root/disable-client.sh phone
|
||||
```
|
||||
|
||||
### Enable a disabled client
|
||||
|
||||
```bash
|
||||
/root/enable-client.sh phone
|
||||
```
|
||||
|
||||
### Permanently remove a client
|
||||
|
||||
```bash
|
||||
/root/remove-client.sh phone
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Tunnel not working
|
||||
|
||||
**Check WireGuard status:**
|
||||
```bash
|
||||
# On both servers
|
||||
wg show
|
||||
systemctl status wg-quick@wg0
|
||||
systemctl status wg-quick@wg1 # RU only
|
||||
```
|
||||
|
||||
**Check if ports are open:**
|
||||
```bash
|
||||
# On DE VDS
|
||||
ss -ulnp | grep 51821
|
||||
|
||||
# On RU VDS
|
||||
ss -ulnp | grep 51820
|
||||
```
|
||||
|
||||
**Check firewall:**
|
||||
```bash
|
||||
nft list ruleset
|
||||
```
|
||||
|
||||
### DNS not working
|
||||
|
||||
**Check dnsmasq:**
|
||||
```bash
|
||||
# On RU VDS
|
||||
systemctl status dnsmasq
|
||||
journalctl -u dnsmasq -n 50
|
||||
```
|
||||
|
||||
**Test DNS locally:**
|
||||
```bash
|
||||
dig @127.0.0.1 google.com
|
||||
dig @10.10.0.1 yandex.ru
|
||||
```
|
||||
|
||||
### Routing not working
|
||||
|
||||
**Check routing tables:**
|
||||
```bash
|
||||
# On RU VDS
|
||||
ip route show table proxy
|
||||
ip rule show
|
||||
```
|
||||
|
||||
**Check ipset:**
|
||||
```bash
|
||||
ipset list direct
|
||||
```
|
||||
|
||||
**Check iptables mangle:**
|
||||
```bash
|
||||
iptables -t mangle -L -v
|
||||
```
|
||||
|
||||
### Client can't connect
|
||||
|
||||
**Check client config:**
|
||||
- Correct server IP (176.124.216.197)
|
||||
- Correct port (51820)
|
||||
- Correct DNS (10.10.0.1)
|
||||
|
||||
**Check server logs:**
|
||||
```bash
|
||||
# On RU VDS
|
||||
journalctl -u wg-quick@wg0 -f
|
||||
```
|
||||
|
||||
**Check if peer is added:**
|
||||
```bash
|
||||
wg show wg0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Maintenance
|
||||
|
||||
### View logs
|
||||
|
||||
```bash
|
||||
# WireGuard
|
||||
journalctl -u wg-quick@wg0 -f
|
||||
journalctl -u wg-quick@wg1 -f
|
||||
|
||||
# dnsmasq
|
||||
journalctl -u dnsmasq -f
|
||||
|
||||
# System
|
||||
dmesg | grep -i wireguard
|
||||
```
|
||||
|
||||
### Restart services
|
||||
|
||||
```bash
|
||||
# RU VDS
|
||||
systemctl restart wg-quick@wg0
|
||||
systemctl restart wg-quick@wg1
|
||||
systemctl restart dnsmasq
|
||||
|
||||
# DE VDS
|
||||
systemctl restart wg-quick@wg0
|
||||
```
|
||||
|
||||
### Update system packages
|
||||
|
||||
```bash
|
||||
apt update && apt upgrade -y
|
||||
```
|
||||
|
||||
### Backup configurations
|
||||
|
||||
```bash
|
||||
# On both servers
|
||||
tar -czf wireguard-backup-$(date +%Y%m%d).tar.gz /etc/wireguard/
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
1. **Change SSH port** from default 22
|
||||
2. **Use SSH keys** instead of passwords
|
||||
3. **Enable automatic security updates:**
|
||||
```bash
|
||||
apt install unattended-upgrades
|
||||
dpkg-reconfigure -plow unattended-upgrades
|
||||
```
|
||||
4. **Monitor logs** regularly
|
||||
5. **Keep WireGuard keys secure** - never share them
|
||||
6. **Rotate client keys** periodically
|
||||
7. **Remove unused clients** promptly
|
||||
|
||||
---
|
||||
|
||||
## Performance Optimization
|
||||
|
||||
### If experiencing slow speeds:
|
||||
|
||||
1. **Check MTU settings:**
|
||||
```bash
|
||||
# Add to WireGuard config
|
||||
MTU = 1420
|
||||
```
|
||||
|
||||
2. **Enable BBR congestion control:**
|
||||
```bash
|
||||
echo "net.core.default_qdisc=fq" >> /etc/sysctl.d/99-vpn.conf
|
||||
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.d/99-vpn.conf
|
||||
sysctl -p /etc/sysctl.d/99-vpn.conf
|
||||
```
|
||||
|
||||
3. **Increase UDP buffer sizes:**
|
||||
```bash
|
||||
echo "net.core.rmem_max=2500000" >> /etc/sysctl.d/99-vpn.conf
|
||||
echo "net.core.wmem_max=2500000" >> /etc/sysctl.d/99-vpn.conf
|
||||
sysctl -p /etc/sysctl.d/99-vpn.conf
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
- [ ] Deploy to production servers
|
||||
- [ ] Add first client
|
||||
- [ ] Test routing for .ru domains
|
||||
- [ ] Test routing for international domains
|
||||
- [ ] Set up monitoring (optional)
|
||||
- [ ] Document server access credentials securely
|
||||
- [ ] Schedule regular backups
|
||||
|
||||
---
|
||||
|
||||
## Quick Reference
|
||||
|
||||
### Key Files
|
||||
|
||||
**DE VDS:**
|
||||
- `/etc/wireguard/wg0.conf` - WireGuard config
|
||||
- `/etc/nftables.conf` - Firewall rules
|
||||
- `/etc/wireguard/keys/` - WireGuard keys
|
||||
|
||||
**RU VDS:**
|
||||
- `/etc/wireguard/wg0.conf` - User VPN config
|
||||
- `/etc/wireguard/wg1.conf` - DE tunnel config
|
||||
- `/etc/wireguard/postup.sh` - Routing setup
|
||||
- `/etc/wireguard/postdown.sh` - Routing cleanup
|
||||
- `/etc/dnsmasq.d/vpn-routing.conf` - DNS config
|
||||
- `/etc/nftables.conf` - Firewall rules
|
||||
- `/etc/wireguard/clients/` - Client configs
|
||||
|
||||
### Common Commands
|
||||
|
||||
```bash
|
||||
# Check WireGuard status
|
||||
wg show
|
||||
|
||||
# List clients
|
||||
/root/list-clients.sh
|
||||
|
||||
# Add client
|
||||
/root/add-client.sh <name>
|
||||
|
||||
# View logs
|
||||
journalctl -u wg-quick@wg0 -f
|
||||
|
||||
# Test tunnel
|
||||
ping 10.20.0.2
|
||||
|
||||
# Check routing
|
||||
ip route show table proxy
|
||||
ipset list direct
|
||||
```
|
||||
684
IMPLEMENTATION.md
Normal file
684
IMPLEMENTATION.md
Normal file
@@ -0,0 +1,684 @@
|
||||
# Implementation Plan
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- SSH access to both VDS servers (RU: 176.124.216.197, DE: 194.31.173.178)
|
||||
- Root or sudo privileges on both servers
|
||||
- Basic firewall rules allowing SSH access
|
||||
|
||||
---
|
||||
|
||||
## Phase 1: DE VDS Setup (Exit Node)
|
||||
|
||||
The simpler node - just accepts traffic from RU VDS and NATs it to the internet.
|
||||
|
||||
### Step 1.1: Install packages
|
||||
|
||||
```bash
|
||||
apt update && apt install -y wireguard nftables
|
||||
```
|
||||
|
||||
### Step 1.2: Enable IP forwarding
|
||||
|
||||
```bash
|
||||
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.d/99-vpn.conf
|
||||
sysctl -p /etc/sysctl.d/99-vpn.conf
|
||||
```
|
||||
|
||||
### Step 1.3: Generate WireGuard keys
|
||||
|
||||
```bash
|
||||
mkdir -p /etc/wireguard/keys
|
||||
chmod 700 /etc/wireguard/keys
|
||||
wg genkey | tee /etc/wireguard/keys/server.key | wg pubkey > /etc/wireguard/keys/server.pub
|
||||
chmod 600 /etc/wireguard/keys/*
|
||||
```
|
||||
|
||||
### Step 1.4: Create WireGuard config
|
||||
|
||||
Create `/etc/wireguard/wg0.conf`:
|
||||
|
||||
```ini
|
||||
[Interface]
|
||||
Address = 10.20.0.2/30
|
||||
ListenPort = 51821
|
||||
PrivateKey = <DE_SERVER_PRIVATE_KEY>
|
||||
PostUp = nft -f /etc/nftables.conf
|
||||
PostDown = nft flush ruleset
|
||||
|
||||
[Peer]
|
||||
# RU VDS
|
||||
PublicKey = <RU_SERVER_PUBLIC_KEY>
|
||||
AllowedIPs = 10.20.0.1/32, 10.10.0.0/24
|
||||
```
|
||||
|
||||
### Step 1.5: Configure nftables
|
||||
|
||||
Create `/etc/nftables.conf`:
|
||||
|
||||
```nft
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
|
||||
# Allow loopback
|
||||
iif lo accept
|
||||
|
||||
# Allow SSH (adjust port if needed)
|
||||
tcp dport 22 accept
|
||||
|
||||
# Allow WireGuard from RU VDS only
|
||||
ip saddr 176.124.216.197 udp dport 51821 accept
|
||||
|
||||
# Allow ICMP
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
# Allow forwarding from VPN
|
||||
iifname "wg0" accept
|
||||
|
||||
# Allow established connections back
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT traffic from VPN to internet
|
||||
oifname != "wg0" ip saddr { 10.10.0.0/24, 10.20.0.0/30 } masquerade
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Step 1.6: Enable and start services
|
||||
|
||||
```bash
|
||||
systemctl enable --now nftables
|
||||
systemctl enable --now wg-quick@wg0
|
||||
```
|
||||
|
||||
### Step 1.7: Verify
|
||||
|
||||
```bash
|
||||
wg show
|
||||
ip addr show wg0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: RU VDS Setup (Gateway)
|
||||
|
||||
The main node - handles user connections, DNS-based routing decisions.
|
||||
|
||||
### Step 2.1: Install packages
|
||||
|
||||
```bash
|
||||
apt update && apt install -y wireguard dnsmasq nftables ipset
|
||||
```
|
||||
|
||||
### Step 2.2: Enable IP forwarding
|
||||
|
||||
```bash
|
||||
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.d/99-vpn.conf
|
||||
sysctl -p /etc/sysctl.d/99-vpn.conf
|
||||
```
|
||||
|
||||
### Step 2.3: Generate WireGuard keys
|
||||
|
||||
```bash
|
||||
mkdir -p /etc/wireguard/keys
|
||||
chmod 700 /etc/wireguard/keys
|
||||
|
||||
# Server key for user-facing interface
|
||||
wg genkey | tee /etc/wireguard/keys/server.key | wg pubkey > /etc/wireguard/keys/server.pub
|
||||
|
||||
# Key for DE tunnel
|
||||
wg genkey | tee /etc/wireguard/keys/de-tunnel.key | wg pubkey > /etc/wireguard/keys/de-tunnel.pub
|
||||
|
||||
chmod 600 /etc/wireguard/keys/*
|
||||
```
|
||||
|
||||
### Step 2.4: Create routing tables
|
||||
|
||||
Add to `/etc/iproute2/rt_tables`:
|
||||
|
||||
```
|
||||
200 proxy
|
||||
```
|
||||
|
||||
### Step 2.5: Create WireGuard configs
|
||||
|
||||
Create `/etc/wireguard/wg0.conf` (user-facing):
|
||||
|
||||
```ini
|
||||
[Interface]
|
||||
Address = 10.10.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = <RU_SERVER_PRIVATE_KEY>
|
||||
PostUp = /etc/wireguard/postup.sh
|
||||
PostDown = /etc/wireguard/postdown.sh
|
||||
|
||||
# Users will be added here as [Peer] sections
|
||||
```
|
||||
|
||||
Create `/etc/wireguard/wg1.conf` (DE tunnel):
|
||||
|
||||
```ini
|
||||
[Interface]
|
||||
Address = 10.20.0.1/30
|
||||
PrivateKey = <RU_DE_TUNNEL_PRIVATE_KEY>
|
||||
|
||||
[Peer]
|
||||
# DE VDS
|
||||
PublicKey = <DE_SERVER_PUBLIC_KEY>
|
||||
Endpoint = 194.31.173.178:51821
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
PersistentKeepalive = 25
|
||||
```
|
||||
|
||||
### Step 2.6: Create PostUp script
|
||||
|
||||
Create `/etc/wireguard/postup.sh`:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
# Create ipsets for routing decisions
|
||||
ipset create direct hash:net -exist
|
||||
ipset create proxy hash:net -exist
|
||||
|
||||
# Add default route via DE tunnel for 'proxy' table
|
||||
ip route add default via 10.20.0.2 table proxy
|
||||
|
||||
# Load nftables rules
|
||||
nft -f /etc/nftables.conf
|
||||
```
|
||||
|
||||
Make executable:
|
||||
```bash
|
||||
chmod +x /etc/wireguard/postup.sh
|
||||
```
|
||||
|
||||
### Step 2.7: Create PostDown script
|
||||
|
||||
Create `/etc/wireguard/postdown.sh`:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
# Flush routing table
|
||||
ip route flush table proxy
|
||||
|
||||
# Destroy ipsets
|
||||
ipset destroy direct 2>/dev/null
|
||||
ipset destroy proxy 2>/dev/null
|
||||
|
||||
# Flush nftables
|
||||
nft flush ruleset
|
||||
```
|
||||
|
||||
Make executable:
|
||||
```bash
|
||||
chmod +x /etc/wireguard/postdown.sh
|
||||
```
|
||||
|
||||
### Step 2.8: Configure nftables
|
||||
|
||||
Create `/etc/nftables.conf`:
|
||||
|
||||
```nft
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# Allow established
|
||||
ct state established,related accept
|
||||
|
||||
# Allow loopback
|
||||
iif lo accept
|
||||
|
||||
# Allow SSH
|
||||
tcp dport 22 accept
|
||||
|
||||
# Allow WireGuard from anywhere (user connections)
|
||||
udp dport 51820 accept
|
||||
|
||||
# Allow DNS from VPN clients only
|
||||
iifname "wg0" udp dport 53 accept
|
||||
iifname "wg0" tcp dport 53 accept
|
||||
|
||||
# Allow ICMP
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
# Allow forwarding from user VPN
|
||||
iifname "wg0" accept
|
||||
|
||||
# Allow forwarding from DE tunnel
|
||||
iifname "wg1" accept
|
||||
|
||||
# Allow established
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT direct traffic (going out main interface)
|
||||
oifname != "wg0" oifname != "wg1" ip saddr 10.10.0.0/24 masquerade
|
||||
}
|
||||
}
|
||||
|
||||
table inet mangle {
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority -150;
|
||||
|
||||
# Mark packets destined for 'proxy' ipset
|
||||
ip daddr @proxy meta mark set 0x1
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Note:** nftables native sets will be used instead of ipset. See Step 2.10 for updated approach.
|
||||
|
||||
### Step 2.9: Configure dnsmasq
|
||||
|
||||
Disable systemd-resolved if running:
|
||||
```bash
|
||||
systemctl disable --now systemd-resolved
|
||||
rm /etc/resolv.conf
|
||||
echo "nameserver 8.8.8.8" > /etc/resolv.conf
|
||||
```
|
||||
|
||||
Create `/etc/dnsmasq.d/vpn-routing.conf`:
|
||||
|
||||
```conf
|
||||
# Listen only on VPN interface
|
||||
interface=wg0
|
||||
bind-interfaces
|
||||
|
||||
# Upstream DNS
|
||||
server=8.8.8.8
|
||||
server=8.8.4.4
|
||||
|
||||
# Don't read /etc/resolv.conf
|
||||
no-resolv
|
||||
|
||||
# Cache size
|
||||
cache-size=10000
|
||||
|
||||
# Log queries (optional, disable in production)
|
||||
# log-queries
|
||||
|
||||
# Russian TLDs - route directly (add to 'direct' ipset)
|
||||
ipset=/ru/direct
|
||||
ipset=/рф/direct
|
||||
ipset=/su/direct
|
||||
|
||||
# Everything else goes to proxy (default)
|
||||
# This is handled by routing table, not ipset
|
||||
```
|
||||
|
||||
**Important:** dnsmasq's ipset feature requires ipset, not nftables sets. We'll use a hybrid approach.
|
||||
|
||||
### Step 2.10: Updated routing approach (hybrid ipset + nftables)
|
||||
|
||||
Since dnsmasq works with ipset, we'll use ipset for the sets and nftables for the rules.
|
||||
|
||||
Update `/etc/nftables.conf`:
|
||||
|
||||
```nft
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
ct state established,related accept
|
||||
iif lo accept
|
||||
tcp dport 22 accept
|
||||
udp dport 51820 accept
|
||||
iifname "wg0" udp dport 53 accept
|
||||
iifname "wg0" tcp dport 53 accept
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
iifname "wg0" accept
|
||||
iifname "wg1" accept
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT direct traffic going out main interface
|
||||
oifname != "wg0" oifname != "wg1" ip saddr 10.10.0.0/24 masquerade
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Update `/etc/wireguard/postup.sh`:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
# Create ipsets
|
||||
ipset create direct hash:net -exist
|
||||
ipset flush direct
|
||||
|
||||
# Add default route via DE tunnel for 'proxy' table
|
||||
ip route add default via 10.20.0.2 table proxy 2>/dev/null || true
|
||||
|
||||
# Policy routing: packets NOT going to 'direct' ipset use 'proxy' table
|
||||
ip rule add from 10.10.0.0/24 fwmark 0x1 table proxy priority 100 2>/dev/null || true
|
||||
|
||||
# Load nftables
|
||||
nft -f /etc/nftables.conf
|
||||
|
||||
# Add iptables rule for fwmark (nftables mangle is complex with ipset)
|
||||
iptables -t mangle -A PREROUTING -m set ! --match-set direct dst -s 10.10.0.0/24 -j MARK --set-mark 0x1
|
||||
```
|
||||
|
||||
Update `/etc/wireguard/postdown.sh`:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
ip rule del from 10.10.0.0/24 fwmark 0x1 table proxy priority 100 2>/dev/null || true
|
||||
ip route flush table proxy 2>/dev/null || true
|
||||
iptables -t mangle -F PREROUTING 2>/dev/null || true
|
||||
ipset destroy direct 2>/dev/null || true
|
||||
nft flush ruleset
|
||||
```
|
||||
|
||||
### Step 2.11: Enable and start services
|
||||
|
||||
```bash
|
||||
systemctl enable --now dnsmasq
|
||||
systemctl enable --now wg-quick@wg0
|
||||
systemctl enable --now wg-quick@wg1
|
||||
```
|
||||
|
||||
### Step 2.12: Verify
|
||||
|
||||
```bash
|
||||
wg show
|
||||
ip route show table proxy
|
||||
ipset list direct
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Key Exchange
|
||||
|
||||
After generating keys on both servers, exchange public keys:
|
||||
|
||||
### On DE VDS:
|
||||
```bash
|
||||
cat /etc/wireguard/keys/server.pub
|
||||
# Copy this value
|
||||
```
|
||||
|
||||
### On RU VDS:
|
||||
```bash
|
||||
cat /etc/wireguard/keys/server.pub
|
||||
cat /etc/wireguard/keys/de-tunnel.pub
|
||||
# Copy these values
|
||||
```
|
||||
|
||||
### Update configs:
|
||||
|
||||
1. **DE VDS** `/etc/wireguard/wg0.conf`: Replace `<RU_SERVER_PUBLIC_KEY>` with RU's `de-tunnel.pub`
|
||||
2. **RU VDS** `/etc/wireguard/wg1.conf`: Replace `<DE_SERVER_PUBLIC_KEY>` with DE's `server.pub`
|
||||
|
||||
### Restart WireGuard:
|
||||
|
||||
```bash
|
||||
# On DE VDS
|
||||
systemctl restart wg-quick@wg0
|
||||
|
||||
# On RU VDS
|
||||
systemctl restart wg-quick@wg1
|
||||
```
|
||||
|
||||
### Verify tunnel:
|
||||
|
||||
```bash
|
||||
# On RU VDS
|
||||
ping 10.20.0.2
|
||||
wg show wg1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: Add First Client
|
||||
|
||||
### Step 4.1: Generate client keys (on RU VDS)
|
||||
|
||||
```bash
|
||||
CLIENT_NAME="phone"
|
||||
wg genkey | tee /etc/wireguard/keys/client_${CLIENT_NAME}.key | wg pubkey > /etc/wireguard/keys/client_${CLIENT_NAME}.pub
|
||||
chmod 600 /etc/wireguard/keys/client_${CLIENT_NAME}.*
|
||||
```
|
||||
|
||||
### Step 4.2: Add peer to server
|
||||
|
||||
```bash
|
||||
CLIENT_IP="10.10.0.2"
|
||||
CLIENT_PUBKEY=$(cat /etc/wireguard/keys/client_${CLIENT_NAME}.pub)
|
||||
|
||||
wg set wg0 peer ${CLIENT_PUBKEY} allowed-ips ${CLIENT_IP}/32
|
||||
wg-quick save wg0
|
||||
```
|
||||
|
||||
### Step 4.3: Create client config
|
||||
|
||||
```bash
|
||||
CLIENT_NAME="phone"
|
||||
CLIENT_IP="10.10.0.2"
|
||||
SERVER_PUBKEY=$(cat /etc/wireguard/keys/server.pub)
|
||||
CLIENT_PRIVKEY=$(cat /etc/wireguard/keys/client_${CLIENT_NAME}.key)
|
||||
|
||||
cat > /etc/wireguard/clients/${CLIENT_NAME}.conf << EOF
|
||||
[Interface]
|
||||
PrivateKey = ${CLIENT_PRIVKEY}
|
||||
Address = ${CLIENT_IP}/32
|
||||
DNS = 10.10.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = ${SERVER_PUBKEY}
|
||||
Endpoint = 176.124.216.197:51820
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
mkdir -p /etc/wireguard/clients
|
||||
chmod 600 /etc/wireguard/clients/${CLIENT_NAME}.conf
|
||||
```
|
||||
|
||||
### Step 4.4: Transfer to client
|
||||
|
||||
Display as QR code (for mobile):
|
||||
```bash
|
||||
apt install -y qrencode
|
||||
qrencode -t ansiutf8 < /etc/wireguard/clients/${CLIENT_NAME}.conf
|
||||
```
|
||||
|
||||
Or copy the file contents manually.
|
||||
|
||||
---
|
||||
|
||||
## Phase 5: Testing
|
||||
|
||||
### Test 1: Basic connectivity
|
||||
|
||||
```bash
|
||||
# From client
|
||||
ping 10.10.0.1 # Should work - RU VDS
|
||||
ping 10.20.0.2 # Should work - DE VDS
|
||||
```
|
||||
|
||||
### Test 2: DNS resolution
|
||||
|
||||
```bash
|
||||
# From client
|
||||
nslookup google.com 10.10.0.1
|
||||
nslookup yandex.ru 10.10.0.1
|
||||
```
|
||||
|
||||
### Test 3: Routing verification
|
||||
|
||||
```bash
|
||||
# On RU VDS - check ipset after client visits some .ru sites
|
||||
ipset list direct
|
||||
|
||||
# From client - check external IP
|
||||
curl ifconfig.me # Should show DE VDS IP (194.31.173.178)
|
||||
curl ifconfig.me --resolve ifconfig.me:80:$(dig +short yandex.ru | head -1) # Won't work, but...
|
||||
|
||||
# Better test - check where traffic goes
|
||||
curl https://2ip.ru # Russian service, should go direct, show RU VDS IP
|
||||
curl https://ifconfig.me # Should show DE VDS IP
|
||||
```
|
||||
|
||||
### Test 4: Check that .ru domains go direct
|
||||
|
||||
```bash
|
||||
# From client
|
||||
traceroute yandex.ru # Should not go through DE
|
||||
traceroute google.com # Should go through DE (you'll see 10.20.0.x hop)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### WireGuard not connecting
|
||||
|
||||
```bash
|
||||
# Check if service is running
|
||||
systemctl status wg-quick@wg0
|
||||
|
||||
# Check for errors
|
||||
journalctl -u wg-quick@wg0 -e
|
||||
|
||||
# Verify port is open
|
||||
ss -ulnp | grep 51820
|
||||
```
|
||||
|
||||
### DNS not working
|
||||
|
||||
```bash
|
||||
# Check dnsmasq
|
||||
systemctl status dnsmasq
|
||||
journalctl -u dnsmasq -e
|
||||
|
||||
# Test locally
|
||||
dig @127.0.0.1 google.com
|
||||
```
|
||||
|
||||
### Routing not working
|
||||
|
||||
```bash
|
||||
# Check ipset
|
||||
ipset list direct
|
||||
|
||||
# Check routing table
|
||||
ip route show table proxy
|
||||
ip rule show
|
||||
|
||||
# Check marks
|
||||
iptables -t mangle -L -v
|
||||
|
||||
# Test marking
|
||||
ping -c 1 8.8.8.8
|
||||
conntrack -L | grep 8.8.8.8
|
||||
```
|
||||
|
||||
### Traffic not NATed
|
||||
|
||||
```bash
|
||||
# Check nftables
|
||||
nft list ruleset
|
||||
|
||||
# Check forwarding
|
||||
cat /proc/sys/net/ipv4/ip_forward
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Summary Checklist
|
||||
|
||||
- [ ] **DE VDS**
|
||||
- [ ] WireGuard installed
|
||||
- [ ] IP forwarding enabled
|
||||
- [ ] Keys generated
|
||||
- [ ] wg0.conf configured
|
||||
- [ ] nftables configured
|
||||
- [ ] Services enabled and started
|
||||
|
||||
- [ ] **RU VDS**
|
||||
- [ ] WireGuard installed
|
||||
- [ ] dnsmasq installed
|
||||
- [ ] ipset installed
|
||||
- [ ] IP forwarding enabled
|
||||
- [ ] Keys generated
|
||||
- [ ] Routing table 'proxy' added
|
||||
- [ ] wg0.conf configured (users)
|
||||
- [ ] wg1.conf configured (DE tunnel)
|
||||
- [ ] postup.sh / postdown.sh created
|
||||
- [ ] nftables configured
|
||||
- [ ] dnsmasq configured
|
||||
- [ ] Services enabled and started
|
||||
|
||||
- [ ] **Key Exchange**
|
||||
- [ ] DE public key → RU wg1.conf
|
||||
- [ ] RU de-tunnel public key → DE wg0.conf
|
||||
- [ ] Tunnel verified (ping 10.20.0.2 from RU)
|
||||
|
||||
- [ ] **First Client**
|
||||
- [ ] Keys generated
|
||||
- [ ] Peer added to wg0
|
||||
- [ ] Client config created
|
||||
- [ ] Connection tested
|
||||
- [ ] Routing verified
|
||||
262
PRE_DEPLOYMENT_CHECKLIST.md
Normal file
262
PRE_DEPLOYMENT_CHECKLIST.md
Normal file
@@ -0,0 +1,262 @@
|
||||
# Pre-Deployment Checklist
|
||||
|
||||
Complete this checklist before deploying to production servers.
|
||||
|
||||
## Infrastructure Verification
|
||||
|
||||
### RU VDS (176.124.216.197)
|
||||
|
||||
- [ ] Can SSH into server: `ssh root@176.124.216.197`
|
||||
- [ ] Have root access: `sudo -i` or logged in as root
|
||||
- [ ] Server is Debian 12 (or compatible): `cat /etc/debian_version`
|
||||
- [ ] Adequate resources:
|
||||
- [ ] At least 1GB RAM: `free -h`
|
||||
- [ ] At least 5GB free disk: `df -h`
|
||||
- [ ] CPU is reasonable: `lscpu`
|
||||
- [ ] Internet connectivity: `ping -c 4 8.8.8.8`
|
||||
- [ ] Can resolve DNS: `nslookup google.com`
|
||||
- [ ] Port 51820/udp not in use: `ss -ulnp | grep 51820` (should be empty)
|
||||
- [ ] Port 53 not in use by another service: `ss -ulnp | grep :53` (or just systemd-resolved)
|
||||
|
||||
### DE VDS (194.31.173.178)
|
||||
|
||||
- [ ] Can SSH into server: `ssh root@194.31.173.178`
|
||||
- [ ] Have root access: `sudo -i` or logged in as root
|
||||
- [ ] Server is Debian 13 (or compatible): `cat /etc/debian_version`
|
||||
- [ ] Adequate resources:
|
||||
- [ ] At least 512MB RAM: `free -h`
|
||||
- [ ] At least 5GB free disk: `df -h`
|
||||
- [ ] CPU is reasonable: `lscpu`
|
||||
- [ ] Internet connectivity: `ping -c 4 8.8.8.8`
|
||||
- [ ] Can resolve DNS: `nslookup google.com`
|
||||
- [ ] Port 51821/udp not in use: `ss -ulnp | grep 51821` (should be empty)
|
||||
|
||||
### Network Connectivity
|
||||
|
||||
- [ ] RU VDS can reach DE VDS: `ping -c 4 194.31.173.178` (from RU VDS)
|
||||
- [ ] DE VDS can reach RU VDS: `ping -c 4 176.124.216.197` (from DE VDS)
|
||||
- [ ] No firewall blocking UDP between servers (if any external firewall exists)
|
||||
|
||||
## Security Preparation
|
||||
|
||||
### SSH Access
|
||||
|
||||
- [ ] Have backup SSH access method (console access, VNC, etc.)
|
||||
- [ ] Know how to access server if SSH breaks
|
||||
- [ ] Current SSH session is stable
|
||||
- [ ] Consider opening second SSH session before making changes
|
||||
|
||||
### Firewall Considerations
|
||||
|
||||
- [ ] Understand current firewall setup (if any): `iptables -L -n` or `nft list ruleset`
|
||||
- [ ] Have documented how to disable firewall if something goes wrong
|
||||
- [ ] Won't lock yourself out when applying new firewall rules
|
||||
|
||||
### Backup Current State
|
||||
|
||||
- [ ] Backup current network config: `cp /etc/network/interfaces /root/interfaces.backup` (if applicable)
|
||||
- [ ] Backup current SSH config: `cp /etc/ssh/sshd_config /root/sshd_config.backup`
|
||||
- [ ] Know how to rollback changes if needed
|
||||
|
||||
## Client Device Preparation
|
||||
|
||||
- [ ] Have at least one device to test VPN client
|
||||
- [ ] WireGuard app installed on test device:
|
||||
- iOS/Android: WireGuard app from App Store/Play Store
|
||||
- Windows: WireGuard from wireguard.com
|
||||
- macOS: WireGuard from App Store or wireguard.com
|
||||
- Linux: `apt install wireguard-tools`
|
||||
- [ ] Device can scan QR codes (for mobile) or can copy/paste config text
|
||||
|
||||
## Tools and Access
|
||||
|
||||
### Local Machine
|
||||
|
||||
- [ ] Have SSH access from local machine to both servers
|
||||
- [ ] Can copy files via SCP: `scp test.txt root@176.124.216.197:/tmp/` works
|
||||
- [ ] Have text editor ready for editing configs
|
||||
- [ ] Have terminal with multiple tabs/windows open
|
||||
|
||||
### Required Information
|
||||
|
||||
- [ ] DE VDS IP: 194.31.173.178 (confirmed)
|
||||
- [ ] RU VDS IP: 176.124.216.197 (confirmed)
|
||||
- [ ] Root password or SSH keys for both servers
|
||||
- [ ] Know which local device will be first test client
|
||||
|
||||
## Time and Planning
|
||||
|
||||
- [ ] Have allocated 1-2 hours for deployment
|
||||
- [ ] Not during critical business hours (in case of issues)
|
||||
- [ ] Have time for troubleshooting if needed
|
||||
- [ ] Not in a rush
|
||||
|
||||
## Documentation Review
|
||||
|
||||
- [ ] Read QUICKSTART.md overview
|
||||
- [ ] Reviewed DEPLOYMENT.md deployment steps
|
||||
- [ ] Know where to find troubleshooting info (DEPLOYMENT.md)
|
||||
- [ ] Have TESTING.md ready for post-deployment tests
|
||||
|
||||
## Script Verification
|
||||
|
||||
### Check scripts are ready
|
||||
|
||||
```bash
|
||||
cd /home/mish/vpn.git
|
||||
ls -la scripts/
|
||||
```
|
||||
|
||||
Should see:
|
||||
- [ ] setup-de-vds.sh (executable)
|
||||
- [ ] setup-ru-vds.sh (executable)
|
||||
- [ ] add-client.sh (executable)
|
||||
- [ ] disable-client.sh (executable)
|
||||
- [ ] enable-client.sh (executable)
|
||||
- [ ] remove-client.sh (executable)
|
||||
- [ ] list-clients.sh (executable)
|
||||
|
||||
## Configuration Files Check
|
||||
|
||||
```bash
|
||||
cd /home/mish/vpn.git
|
||||
ls -la configs/de-vds/
|
||||
ls -la configs/ru-vds/
|
||||
```
|
||||
|
||||
Should see all required config files.
|
||||
|
||||
## Risk Assessment
|
||||
|
||||
### Understand the risks
|
||||
|
||||
- [ ] Understand that changes will be made to network configuration
|
||||
- [ ] Understand that firewall rules will be modified
|
||||
- [ ] Understand that new services will be installed
|
||||
- [ ] Have rollback plan if things go wrong
|
||||
- [ ] Won't lose access to servers (have console/recovery access)
|
||||
|
||||
### Rollback Plan
|
||||
|
||||
If something goes wrong:
|
||||
|
||||
**DE VDS:**
|
||||
```bash
|
||||
# Stop services
|
||||
systemctl stop wg-quick@wg0
|
||||
systemctl stop nftables
|
||||
|
||||
# Flush firewall
|
||||
nft flush ruleset
|
||||
iptables -F
|
||||
iptables -X
|
||||
iptables -t nat -F
|
||||
iptables -t nat -X
|
||||
|
||||
# Default accept
|
||||
iptables -P INPUT ACCEPT
|
||||
iptables -P FORWARD ACCEPT
|
||||
iptables -P OUTPUT ACCEPT
|
||||
```
|
||||
|
||||
**RU VDS:**
|
||||
```bash
|
||||
# Stop services
|
||||
systemctl stop wg-quick@wg0
|
||||
systemctl stop wg-quick@wg1
|
||||
systemctl stop dnsmasq
|
||||
|
||||
# Start systemd-resolved if it was stopped
|
||||
systemctl start systemd-resolved
|
||||
|
||||
# Flush firewall (same as above)
|
||||
nft flush ruleset
|
||||
iptables -F
|
||||
iptables -X
|
||||
iptables -t nat -F
|
||||
iptables -t nat -X
|
||||
iptables -P INPUT ACCEPT
|
||||
iptables -P FORWARD ACCEPT
|
||||
iptables -P OUTPUT ACCEPT
|
||||
```
|
||||
|
||||
## Post-Deployment Preparation
|
||||
|
||||
- [ ] Have notepad ready to save:
|
||||
- DE VDS public key
|
||||
- RU VDS server public key
|
||||
- RU VDS DE tunnel public key
|
||||
- [ ] Ready to run tests from TESTING.md
|
||||
- [ ] Have client device ready for connection test
|
||||
|
||||
## Final Verification
|
||||
|
||||
- [ ] All above items checked
|
||||
- [ ] Confident to proceed
|
||||
- [ ] Have time allocated
|
||||
- [ ] No critical dependencies on servers right now
|
||||
- [ ] Ready to start deployment
|
||||
|
||||
---
|
||||
|
||||
## Ready to Deploy?
|
||||
|
||||
If all items are checked, proceed to:
|
||||
|
||||
1. **QUICKSTART.md** - For rapid deployment
|
||||
2. **DEPLOYMENT.md** - For detailed deployment guide
|
||||
|
||||
## Need More Info?
|
||||
|
||||
- Architecture details → README.md
|
||||
- Implementation steps → IMPLEMENTATION.md
|
||||
- Testing procedures → TESTING.md
|
||||
|
||||
---
|
||||
|
||||
## Deployment Day Checklist
|
||||
|
||||
### Morning of deployment
|
||||
|
||||
- [ ] Verify servers are accessible
|
||||
- [ ] Verify servers are up-to-date: `apt update && apt list --upgradable`
|
||||
- [ ] Create snapshot/backup if available from hosting provider
|
||||
- [ ] Notify anyone who might be affected
|
||||
|
||||
### During deployment
|
||||
|
||||
- [ ] Follow DEPLOYMENT.md step by step
|
||||
- [ ] Don't skip verification steps
|
||||
- [ ] Test after each major phase
|
||||
- [ ] Document any issues or deviations
|
||||
|
||||
### After deployment
|
||||
|
||||
- [ ] Complete all tests from TESTING.md
|
||||
- [ ] Verify client can connect
|
||||
- [ ] Verify routing is correct
|
||||
- [ ] Document any configuration changes made
|
||||
- [ ] Save all keys securely
|
||||
|
||||
---
|
||||
|
||||
## Emergency Contacts
|
||||
|
||||
Document here:
|
||||
|
||||
- VDS provider support: _______________________
|
||||
- Backup admin contact: _______________________
|
||||
- Your remote access method: _______________________
|
||||
|
||||
---
|
||||
|
||||
**Date completed:** _______________
|
||||
|
||||
**Completed by:** _______________
|
||||
|
||||
**Ready to proceed:** ☐ Yes ☐ No
|
||||
|
||||
**If No, blockers:**
|
||||
_________________________________
|
||||
_________________________________
|
||||
_________________________________
|
||||
279
PROJECT_SUMMARY.md
Normal file
279
PROJECT_SUMMARY.md
Normal file
@@ -0,0 +1,279 @@
|
||||
# Project Summary
|
||||
|
||||
## Overview
|
||||
|
||||
This project implements a split-tunnel VPN network for bypassing internet restrictions in Russia while maintaining optimal performance for domestic traffic.
|
||||
|
||||
## Architecture
|
||||
|
||||
**3-node setup:**
|
||||
- Client devices (users in Russia)
|
||||
- RU VDS (176.124.216.197) - Gateway with selective routing
|
||||
- DE VDS (194.31.173.178) - Exit node in Germany
|
||||
|
||||
**Key feature:** DNS-based domain routing
|
||||
- `.ru`, `.рф`, `.su` domains → Direct routing (fast, no proxy)
|
||||
- All other domains → Routed through Germany (bypass blocks)
|
||||
|
||||
## Technology Stack
|
||||
|
||||
| Component | Purpose |
|
||||
|-----------|---------|
|
||||
| WireGuard | VPN tunnels (lightweight, fast) |
|
||||
| dnsmasq | DNS server with ipset integration |
|
||||
| nftables | Firewall and NAT |
|
||||
| ipset | IP address sets for routing decisions |
|
||||
| iproute2 | Policy-based routing |
|
||||
|
||||
## What's Included
|
||||
|
||||
### Documentation (5 files)
|
||||
|
||||
1. **README.md** - Architecture overview and reference
|
||||
2. **QUICKSTART.md** - 30-minute setup guide
|
||||
3. **IMPLEMENTATION.md** - Detailed step-by-step implementation
|
||||
4. **DEPLOYMENT.md** - Production deployment guide
|
||||
5. **TESTING.md** - Comprehensive testing checklist
|
||||
|
||||
### Configuration Files (11 files)
|
||||
|
||||
**DE VDS configs:**
|
||||
- `wg0.conf` - WireGuard interface config
|
||||
- `nftables.conf` - Firewall rules (NAT)
|
||||
- `99-vpn.conf` - Kernel parameters (IP forwarding)
|
||||
|
||||
**RU VDS configs:**
|
||||
- `wg0.conf` - User-facing VPN interface
|
||||
- `wg1.conf` - DE tunnel interface
|
||||
- `postup.sh` - Routing setup script
|
||||
- `postdown.sh` - Routing cleanup script
|
||||
- `nftables.conf` - Firewall rules
|
||||
- `vpn-routing.conf` - dnsmasq domain routing
|
||||
- `rt_tables` - Custom routing table definitions
|
||||
- `99-vpn.conf` - Kernel parameters
|
||||
|
||||
**Client template:**
|
||||
- `example-client.conf` - Template for client configs
|
||||
|
||||
### Management Scripts (7 files)
|
||||
|
||||
**Setup:**
|
||||
- `setup-de-vds.sh` - Automated DE VDS setup
|
||||
- `setup-ru-vds.sh` - Automated RU VDS setup
|
||||
|
||||
**Client management:**
|
||||
- `add-client.sh` - Add new VPN client (with QR code)
|
||||
- `remove-client.sh` - Permanently remove client
|
||||
- `disable-client.sh` - Temporarily disable client
|
||||
- `enable-client.sh` - Re-enable disabled client
|
||||
- `list-clients.sh` - List all clients with status
|
||||
|
||||
## Key Features
|
||||
|
||||
### Automated Setup
|
||||
- One-command server deployment
|
||||
- Automatic key generation
|
||||
- Automatic package installation
|
||||
- Automatic service configuration
|
||||
|
||||
### Easy Client Management
|
||||
- Simple CLI commands
|
||||
- Automatic IP assignment
|
||||
- QR code generation for mobile
|
||||
- Enable/disable without key regeneration
|
||||
|
||||
### Smart Routing
|
||||
- Automatic domain-based routing
|
||||
- No manual IP list maintenance
|
||||
- DNS-driven routing decisions
|
||||
- Optimal performance for local traffic
|
||||
|
||||
### Security
|
||||
- WireGuard modern cryptography
|
||||
- Restricted firewall rules
|
||||
- Key-based authentication
|
||||
- Isolated VPN network
|
||||
|
||||
### Scalability
|
||||
- Support for 253 concurrent clients
|
||||
- Low resource usage
|
||||
- Efficient packet routing
|
||||
- No bottlenecks
|
||||
|
||||
## Network Topology
|
||||
|
||||
```
|
||||
Internet
|
||||
▲
|
||||
│
|
||||
┌───────────────┼───────────────┐
|
||||
│ │ │
|
||||
│ Direct (fast) │
|
||||
│ .ru/.рф domains │
|
||||
│ │
|
||||
┌──────────┐ │ ┌──────────────┐ │ ┌──────────┐
|
||||
│ Client │◄───┼───►│ RU VDS │◄─────────┼───►│ DE VDS │
|
||||
│ Device │ │ │ Gateway │ │ │Exit Node │
|
||||
└──────────┘ │ └──────────────┘ │ └──────────┘
|
||||
│ │ │
|
||||
│ │ │
|
||||
│ ▼ │
|
||||
│ Routing Decision │
|
||||
│ (dnsmasq + ipset) │
|
||||
│ │
|
||||
│ WireGuard tunnel │
|
||||
│ (all other domains) │
|
||||
└───────────────────────────────┘
|
||||
```
|
||||
|
||||
## IP Addressing
|
||||
|
||||
- **User VPN:** 10.10.0.0/24 (clients ↔ RU VDS)
|
||||
- 10.10.0.1 - RU VDS gateway
|
||||
- 10.10.0.2-254 - Client IPs
|
||||
|
||||
- **Server VPN:** 10.20.0.0/30 (RU ↔ DE tunnel)
|
||||
- 10.20.0.1 - RU VDS
|
||||
- 10.20.0.2 - DE VDS
|
||||
|
||||
## Deployment Workflow
|
||||
|
||||
1. **Prepare** (5 min)
|
||||
- Verify server access
|
||||
- Copy setup scripts
|
||||
|
||||
2. **Deploy DE VDS** (5 min)
|
||||
- Run setup script
|
||||
- Save public key
|
||||
|
||||
3. **Deploy RU VDS** (5 min)
|
||||
- Run setup script
|
||||
- Save public keys
|
||||
|
||||
4. **Exchange Keys** (3 min)
|
||||
- Update DE config with RU key
|
||||
- Update RU config with DE key
|
||||
|
||||
5. **Start Services** (2 min)
|
||||
- Start DE services
|
||||
- Start RU services
|
||||
|
||||
6. **Verify** (5 min)
|
||||
- Test tunnel connectivity
|
||||
- Check routing tables
|
||||
|
||||
7. **Add Clients** (5 min each)
|
||||
- Run add-client script
|
||||
- Transfer config to device
|
||||
|
||||
**Total time: ~30-40 minutes**
|
||||
|
||||
## Testing Coverage
|
||||
|
||||
Comprehensive testing checklist covers:
|
||||
- Pre-deployment verification
|
||||
- Post-setup validation
|
||||
- Tunnel connectivity
|
||||
- DNS resolution
|
||||
- Routing logic
|
||||
- Client management
|
||||
- Performance benchmarks
|
||||
- Security verification
|
||||
- Failure recovery
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Regular Tasks
|
||||
- Monitor logs for errors
|
||||
- Check client list for inactive users
|
||||
- Review bandwidth usage
|
||||
- Update system packages
|
||||
|
||||
### Backup Strategy
|
||||
- Backup `/etc/wireguard/` directory
|
||||
- Store keys securely offline
|
||||
- Document client assignments
|
||||
|
||||
### Monitoring
|
||||
- WireGuard handshake status
|
||||
- DNS query logs (optional)
|
||||
- System resource usage
|
||||
- Network traffic patterns
|
||||
|
||||
## Troubleshooting Quick Reference
|
||||
|
||||
| Issue | Check | Fix |
|
||||
|-------|-------|-----|
|
||||
| Tunnel down | `wg show` | Restart wg-quick services |
|
||||
| DNS not working | `systemctl status dnsmasq` | Restart dnsmasq |
|
||||
| Routing wrong | `ipset list direct` | Check dnsmasq config |
|
||||
| Client can't connect | `wg show wg0 peers` | Verify peer added |
|
||||
| Slow performance | `ping` tests | Check MTU settings |
|
||||
|
||||
## Security Considerations
|
||||
|
||||
- Keys stored with 600 permissions
|
||||
- Firewall restricts access by IP
|
||||
- DNS only accessible from VPN clients
|
||||
- Separate interfaces for users/tunnel
|
||||
- No logging of DNS queries (configurable)
|
||||
|
||||
## Future Enhancements (Optional)
|
||||
|
||||
Potential additions:
|
||||
- Web UI for client management
|
||||
- Prometheus metrics export
|
||||
- Automated key rotation
|
||||
- Fail-over to secondary DE server
|
||||
- IPv6 support
|
||||
- Traffic statistics dashboard
|
||||
|
||||
## Repository Structure
|
||||
|
||||
```
|
||||
vpn.git/
|
||||
├── README.md # Architecture and reference
|
||||
├── QUICKSTART.md # Fast setup guide
|
||||
├── IMPLEMENTATION.md # Detailed implementation
|
||||
├── DEPLOYMENT.md # Production deployment
|
||||
├── TESTING.md # Testing checklist
|
||||
├── PROJECT_SUMMARY.md # This file
|
||||
├── .gitignore # Git ignore rules
|
||||
├── configs/ # All configuration files
|
||||
│ ├── de-vds/ # DE VDS configs
|
||||
│ ├── ru-vds/ # RU VDS configs
|
||||
│ └── client-templates/ # Client config templates
|
||||
└── scripts/ # Management scripts
|
||||
├── setup-*.sh # Server setup
|
||||
└── *-client.sh # Client management
|
||||
```
|
||||
|
||||
## Success Metrics
|
||||
|
||||
After deployment, you should have:
|
||||
- ✓ Stable VPN tunnel between RU and DE
|
||||
- ✓ Working client connections
|
||||
- ✓ Correct routing for .ru vs other domains
|
||||
- ✓ Simple client management via CLI
|
||||
- ✓ No errors in service logs
|
||||
- ✓ Acceptable performance (latency, bandwidth)
|
||||
|
||||
## Support and Documentation
|
||||
|
||||
All information needed is in this repository:
|
||||
- Architecture → README.md
|
||||
- Quick setup → QUICKSTART.md
|
||||
- Detailed steps → IMPLEMENTATION.md
|
||||
- Deployment → DEPLOYMENT.md
|
||||
- Testing → TESTING.md
|
||||
|
||||
## License
|
||||
|
||||
This is a personal project. Use at your own discretion.
|
||||
|
||||
## Credits
|
||||
|
||||
Built with:
|
||||
- WireGuard - Jason A. Donenfeld
|
||||
- dnsmasq - Simon Kelley
|
||||
- nftables - Netfilter Project
|
||||
207
QUICKSTART.md
Normal file
207
QUICKSTART.md
Normal file
@@ -0,0 +1,207 @@
|
||||
# Quick Start Guide
|
||||
|
||||
Get your VPN network up and running in 30 minutes.
|
||||
|
||||
## What You'll Get
|
||||
|
||||
A VPN network where:
|
||||
- `.ru` and `.рф` domains go directly to the internet (fast, no proxy)
|
||||
- All other domains route through Germany (bypass blocks)
|
||||
- Easy client management via command-line scripts
|
||||
- Support for multiple users (up to 253 devices)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- 2 VDS servers (already have: RU + DE)
|
||||
- SSH access with root privileges
|
||||
- 30 minutes of time
|
||||
|
||||
## Deployment Steps
|
||||
|
||||
### Step 1: Setup DE VDS (5 min)
|
||||
|
||||
```bash
|
||||
# From your computer
|
||||
scp scripts/setup-de-vds.sh root@194.31.173.178:/root/
|
||||
|
||||
# SSH into DE VDS
|
||||
ssh root@194.31.173.178
|
||||
|
||||
# Run setup
|
||||
chmod +x /root/setup-de-vds.sh
|
||||
/root/setup-de-vds.sh
|
||||
|
||||
# Copy the public key that appears (save it for step 3)
|
||||
```
|
||||
|
||||
### Step 2: Setup RU VDS (5 min)
|
||||
|
||||
```bash
|
||||
# From your computer
|
||||
scp scripts/setup-ru-vds.sh root@176.124.216.197:/root/
|
||||
|
||||
# SSH into RU VDS
|
||||
ssh root@176.124.216.197
|
||||
|
||||
# Run setup
|
||||
chmod +x /root/setup-ru-vds.sh
|
||||
/root/setup-ru-vds.sh
|
||||
|
||||
# Copy both public keys that appear (save for step 3)
|
||||
```
|
||||
|
||||
### Step 3: Exchange Keys (3 min)
|
||||
|
||||
**On DE VDS:**
|
||||
```bash
|
||||
nano /etc/wireguard/wg0.conf
|
||||
# Replace __RU_DE_TUNNEL_PUBLIC_KEY__ with RU's "DE tunnel key"
|
||||
# Save and exit (Ctrl+X, Y, Enter)
|
||||
```
|
||||
|
||||
**On RU VDS:**
|
||||
```bash
|
||||
nano /etc/wireguard/wg1.conf
|
||||
# Replace __DE_SERVER_PUBLIC_KEY__ with DE's public key
|
||||
# Save and exit (Ctrl+X, Y, Enter)
|
||||
```
|
||||
|
||||
### Step 4: Start Services (2 min)
|
||||
|
||||
**On DE VDS:**
|
||||
```bash
|
||||
systemctl start nftables
|
||||
systemctl start wg-quick@wg0
|
||||
```
|
||||
|
||||
**On RU VDS:**
|
||||
```bash
|
||||
systemctl start dnsmasq
|
||||
systemctl start wg-quick@wg1
|
||||
systemctl start wg-quick@wg0
|
||||
```
|
||||
|
||||
### Step 5: Verify Tunnel (2 min)
|
||||
|
||||
**On RU VDS:**
|
||||
```bash
|
||||
ping -c 4 10.20.0.2
|
||||
wg show wg1
|
||||
# Should see successful ping and recent handshake
|
||||
```
|
||||
|
||||
### Step 6: Add First Client (5 min)
|
||||
|
||||
**Copy client scripts to RU VDS:**
|
||||
```bash
|
||||
# From your computer
|
||||
scp scripts/*.sh root@176.124.216.197:/root/
|
||||
```
|
||||
|
||||
**On RU VDS:**
|
||||
```bash
|
||||
chmod +x /root/*.sh
|
||||
/root/add-client.sh phone
|
||||
# Scan the QR code with WireGuard app or copy the config
|
||||
```
|
||||
|
||||
### Step 7: Test (5 min)
|
||||
|
||||
**On your client device:**
|
||||
1. Install WireGuard app
|
||||
2. Scan QR code or import config
|
||||
3. Connect to VPN
|
||||
|
||||
**Test it works:**
|
||||
```bash
|
||||
# Should show DE VDS IP (194.31.173.178)
|
||||
curl ifconfig.me
|
||||
|
||||
# Should resolve through VPN DNS
|
||||
nslookup google.com
|
||||
```
|
||||
|
||||
**Test routing:**
|
||||
- Visit google.com → routed through Germany
|
||||
- Visit yandex.ru → routed directly (faster)
|
||||
|
||||
## Done!
|
||||
|
||||
Your VPN is now operational.
|
||||
|
||||
## Common Commands
|
||||
|
||||
```bash
|
||||
# List all clients
|
||||
/root/list-clients.sh
|
||||
|
||||
# Add new client
|
||||
/root/add-client.sh laptop
|
||||
|
||||
# Disable client temporarily
|
||||
/root/disable-client.sh phone
|
||||
|
||||
# Re-enable client
|
||||
/root/enable-client.sh phone
|
||||
|
||||
# Remove client permanently
|
||||
/root/remove-client.sh phone
|
||||
|
||||
# Check VPN status
|
||||
wg show
|
||||
|
||||
# View logs
|
||||
journalctl -u wg-quick@wg0 -f
|
||||
```
|
||||
|
||||
## Need Help?
|
||||
|
||||
- Full implementation details: [IMPLEMENTATION.md](IMPLEMENTATION.md)
|
||||
- Deployment guide: [DEPLOYMENT.md](DEPLOYMENT.md)
|
||||
- Architecture overview: [README.md](README.md)
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
**Tunnel not connecting?**
|
||||
```bash
|
||||
# Check WireGuard status
|
||||
wg show
|
||||
systemctl status wg-quick@wg0
|
||||
|
||||
# Check if ports are open
|
||||
ss -ulnp | grep 51820 # RU VDS
|
||||
ss -ulnp | grep 51821 # DE VDS
|
||||
```
|
||||
|
||||
**DNS not working?**
|
||||
```bash
|
||||
# Check dnsmasq
|
||||
systemctl status dnsmasq
|
||||
journalctl -u dnsmasq -n 50
|
||||
```
|
||||
|
||||
**Routing not working?**
|
||||
```bash
|
||||
# Check ipset after visiting .ru sites
|
||||
ipset list direct
|
||||
|
||||
# Check routing table
|
||||
ip route show table proxy
|
||||
ip rule show
|
||||
```
|
||||
|
||||
## Security Notes
|
||||
|
||||
- Keep WireGuard keys secure (never share them)
|
||||
- Change SSH port from default 22
|
||||
- Use SSH keys instead of passwords
|
||||
- Remove unused clients promptly
|
||||
- Monitor logs regularly
|
||||
|
||||
## Next Steps
|
||||
|
||||
- Add more clients as needed
|
||||
- Set up automatic security updates
|
||||
- Configure backups for `/etc/wireguard/`
|
||||
- Monitor server resources
|
||||
- Consider setting up monitoring/alerting
|
||||
234
README.md
234
README.md
@@ -1,2 +1,234 @@
|
||||
# vpn
|
||||
# VPN Network with Selective Routing
|
||||
|
||||
A WireGuard-based VPN network with selective domain routing. Traffic to `.ru` and `.рф` domains goes directly to the internet, all other traffic is routed through an EU exit node.
|
||||
|
||||
## Architecture Overview
|
||||
|
||||
```
|
||||
┌─────────────┐ WireGuard ┌─────────────┐ WireGuard ┌─────────────┐
|
||||
│ Client │─────────────────────▶│ RU VDS │─────────────────────▶│ DE VDS │
|
||||
│ (Russia) │ 10.10.0.0/24 │ (Gateway) │ 10.20.0.0/24 │ (Exit Node) │
|
||||
└─────────────┘ └─────────────┘ └─────────────┘
|
||||
│ │
|
||||
│ Direct routing │
|
||||
│ for .ru/.рф ▼
|
||||
│ ┌───────────┐
|
||||
└─────────────────────────────▶│ Internet │
|
||||
└───────────┘
|
||||
```
|
||||
|
||||
## Infrastructure
|
||||
|
||||
| Node | Role | IP Address | OS | Specs |
|
||||
|------|------|------------|-----|-------|
|
||||
| RU VDS | Gateway + DNS router | 176.124.216.197 | Debian 12 | 1 CPU, 2GB RAM, 20GB NVMe |
|
||||
| DE VDS | Exit node | 194.31.173.178 | Debian 13 | 1 CPU, 1GB RAM, 15GB NVMe |
|
||||
| Clients | User devices | Dynamic | Any | WireGuard client |
|
||||
|
||||
## Network Design
|
||||
|
||||
### IP Addressing
|
||||
|
||||
| Network | Range | Purpose |
|
||||
|---------|-------|---------|
|
||||
| User VPN | 10.10.0.0/24 | Client ↔ RU VDS tunnel |
|
||||
| Server VPN | 10.20.0.0/30 | RU VDS ↔ DE VDS tunnel |
|
||||
|
||||
### IP Assignments
|
||||
|
||||
**User VPN (10.10.0.0/24):**
|
||||
- 10.10.0.1 - RU VDS (gateway)
|
||||
- 10.10.0.2 - Client #1
|
||||
- 10.10.0.3 - Client #2
|
||||
- ... up to 10.10.0.254
|
||||
|
||||
**Server VPN (10.20.0.0/30):**
|
||||
- 10.20.0.1 - RU VDS
|
||||
- 10.20.0.2 - DE VDS
|
||||
|
||||
### Ports
|
||||
|
||||
| Service | Port | Protocol |
|
||||
|---------|------|----------|
|
||||
| WireGuard (RU VDS, users) | 51820/udp | WireGuard |
|
||||
| WireGuard (DE VDS, server) | 51821/udp | WireGuard |
|
||||
| DNS (RU VDS, internal) | 53/udp | DNS |
|
||||
|
||||
## Routing Logic
|
||||
|
||||
1. Client connects to RU VDS via WireGuard
|
||||
2. Client uses RU VDS as DNS server (10.10.0.1)
|
||||
3. dnsmasq on RU VDS resolves DNS queries:
|
||||
- For `.ru` and `.рф` domains → adds resolved IPs to `direct` ipset
|
||||
- For all other domains → adds resolved IPs to `proxy` ipset
|
||||
4. nftables routes packets based on ipset membership:
|
||||
- IPs in `direct` → route via RU VDS default gateway (direct internet)
|
||||
- IPs in `proxy` → route via DE VDS tunnel (10.20.0.2)
|
||||
|
||||
## Components
|
||||
|
||||
### RU VDS (Gateway)
|
||||
|
||||
- **WireGuard**: Two interfaces
|
||||
- `wg0` - User-facing (10.10.0.1/24)
|
||||
- `wg1` - DE VDS tunnel (10.20.0.1/30)
|
||||
- **dnsmasq**: DNS server with ipset integration
|
||||
- **nftables**: Packet marking and routing
|
||||
- **iproute2**: Policy-based routing tables
|
||||
|
||||
### DE VDS (Exit Node)
|
||||
|
||||
- **WireGuard**: One interface
|
||||
- `wg0` - RU VDS tunnel (10.20.0.2/30)
|
||||
- **nftables**: NAT for outgoing traffic
|
||||
|
||||
## Project Structure
|
||||
|
||||
```
|
||||
vpn.git/
|
||||
├── README.md # Project overview
|
||||
├── IMPLEMENTATION.md # Step-by-step implementation guide
|
||||
├── DEPLOYMENT.md # Deployment guide for production
|
||||
├── configs/ # Configuration files
|
||||
│ ├── de-vds/ # DE VDS configs
|
||||
│ │ ├── wg0.conf # WireGuard config
|
||||
│ │ ├── nftables.conf # Firewall rules
|
||||
│ │ └── 99-vpn.conf # Sysctl settings
|
||||
│ ├── ru-vds/ # RU VDS configs
|
||||
│ │ ├── wg0.conf # User VPN config
|
||||
│ │ ├── wg1.conf # DE tunnel config
|
||||
│ │ ├── postup.sh # Routing setup script
|
||||
│ │ ├── postdown.sh # Routing cleanup script
|
||||
│ │ ├── nftables.conf # Firewall rules
|
||||
│ │ ├── 99-vpn.conf # Sysctl settings
|
||||
│ │ ├── rt_tables # Routing tables
|
||||
│ │ └── vpn-routing.conf # dnsmasq config
|
||||
│ └── client-templates/ # Client config templates
|
||||
│ └── example-client.conf
|
||||
└── scripts/ # Management scripts
|
||||
├── setup-de-vds.sh # DE VDS automated setup
|
||||
├── setup-ru-vds.sh # RU VDS automated setup
|
||||
├── add-client.sh # Add new VPN client
|
||||
├── remove-client.sh # Remove VPN client
|
||||
├── disable-client.sh # Disable VPN client
|
||||
├── enable-client.sh # Enable VPN client
|
||||
└── list-clients.sh # List all clients
|
||||
```
|
||||
|
||||
## Quick Start
|
||||
|
||||
1. **Read the implementation plan:** See [IMPLEMENTATION.md](IMPLEMENTATION.md)
|
||||
2. **Deploy to servers:** Follow [DEPLOYMENT.md](DEPLOYMENT.md)
|
||||
3. **Add clients:** Use scripts in `scripts/` directory
|
||||
|
||||
## Server File Structure
|
||||
|
||||
On the servers, files will be organized as:
|
||||
|
||||
```
|
||||
/etc/wireguard/
|
||||
├── wg0.conf # User VPN interface
|
||||
├── wg1.conf # Server-to-server tunnel (RU only)
|
||||
├── postup.sh # Routing setup (RU only)
|
||||
├── postdown.sh # Routing cleanup (RU only)
|
||||
├── keys/ # Private/public keys
|
||||
└── clients/ # Client configs (RU only)
|
||||
|
||||
/etc/dnsmasq.d/
|
||||
└── vpn-routing.conf # Domain-based routing rules (RU only)
|
||||
|
||||
/etc/nftables.conf # Firewall and NAT rules
|
||||
|
||||
/etc/iproute2/
|
||||
└── rt_tables # Custom routing tables (RU only)
|
||||
```
|
||||
|
||||
## User Management
|
||||
|
||||
Use the provided scripts on RU VDS:
|
||||
|
||||
### Add new user
|
||||
|
||||
```bash
|
||||
/root/add-client.sh <client_name>
|
||||
# Example: /root/add-client.sh phone
|
||||
```
|
||||
|
||||
### List all users
|
||||
|
||||
```bash
|
||||
/root/list-clients.sh
|
||||
```
|
||||
|
||||
### Disable user (temporarily)
|
||||
|
||||
```bash
|
||||
/root/disable-client.sh <client_name>
|
||||
```
|
||||
|
||||
### Enable user
|
||||
|
||||
```bash
|
||||
/root/enable-client.sh <client_name>
|
||||
```
|
||||
|
||||
### Remove user (permanently)
|
||||
|
||||
```bash
|
||||
/root/remove-client.sh <client_name>
|
||||
```
|
||||
|
||||
### Manual management
|
||||
|
||||
If you prefer manual commands:
|
||||
|
||||
```bash
|
||||
# Generate keys
|
||||
wg genkey | tee /etc/wireguard/keys/client_NAME.key | wg pubkey > /etc/wireguard/keys/client_NAME.pub
|
||||
|
||||
# Add peer
|
||||
wg set wg0 peer $(cat /etc/wireguard/keys/client_NAME.pub) allowed-ips 10.10.0.X/32
|
||||
|
||||
# Save config
|
||||
wg-quick save wg0
|
||||
```
|
||||
|
||||
## Security Considerations
|
||||
|
||||
- WireGuard keys are stored in `/etc/wireguard/keys/` with 600 permissions
|
||||
- Only UDP port 51820 is exposed on RU VDS
|
||||
- Only UDP port 51821 is exposed on DE VDS (and only to RU VDS IP)
|
||||
- DNS queries are only accepted from VPN clients (10.10.0.0/24)
|
||||
- IP forwarding is enabled only for necessary interfaces
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Check status
|
||||
|
||||
```bash
|
||||
# WireGuard status
|
||||
wg show
|
||||
|
||||
# Active connections
|
||||
wg show wg0 latest-handshakes
|
||||
|
||||
# DNS cache stats
|
||||
kill -USR1 $(pidof dnsmasq) && journalctl -u dnsmasq -n 20
|
||||
|
||||
# Routing tables
|
||||
ip route show table direct
|
||||
ip route show table proxy
|
||||
```
|
||||
|
||||
### View logs
|
||||
|
||||
```bash
|
||||
journalctl -u wg-quick@wg0 -f
|
||||
journalctl -u dnsmasq -f
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
- [WireGuard Documentation](https://www.wireguard.com/quickstart/)
|
||||
- [dnsmasq ipset feature](https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html)
|
||||
- [nftables wiki](https://wiki.nftables.org/)
|
||||
|
||||
305
TESTING.md
Normal file
305
TESTING.md
Normal file
@@ -0,0 +1,305 @@
|
||||
# Testing Checklist
|
||||
|
||||
Use this checklist to verify your VPN network is working correctly.
|
||||
|
||||
## Pre-Deployment Tests
|
||||
|
||||
### DE VDS
|
||||
|
||||
- [ ] SSH access working
|
||||
- [ ] System updated (`apt update && apt upgrade`)
|
||||
- [ ] Adequate disk space (`df -h`)
|
||||
- [ ] No port conflicts on 51821 (`ss -ulnp | grep 51821`)
|
||||
|
||||
### RU VDS
|
||||
|
||||
- [ ] SSH access working
|
||||
- [ ] System updated (`apt update && apt upgrade`)
|
||||
- [ ] Adequate disk space (`df -h`)
|
||||
- [ ] No port conflicts on 51820 (`ss -ulnp | grep 51820`)
|
||||
- [ ] No DNS conflicts on port 53 (`ss -ulnp | grep :53`)
|
||||
|
||||
## Post-Setup Tests
|
||||
|
||||
### DE VDS
|
||||
|
||||
- [ ] WireGuard installed (`wg version`)
|
||||
- [ ] IP forwarding enabled (`cat /proc/sys/net/ipv4/ip_forward` = 1)
|
||||
- [ ] WireGuard keys generated (`ls /etc/wireguard/keys/`)
|
||||
- [ ] nftables config exists (`ls /etc/nftables.conf`)
|
||||
- [ ] Services enabled (not yet started)
|
||||
|
||||
### RU VDS
|
||||
|
||||
- [ ] WireGuard installed (`wg version`)
|
||||
- [ ] dnsmasq installed (`dnsmasq -v`)
|
||||
- [ ] ipset installed (`ipset -v`)
|
||||
- [ ] IP forwarding enabled (`cat /proc/sys/net/ipv4/ip_forward` = 1)
|
||||
- [ ] WireGuard keys generated (`ls /etc/wireguard/keys/`)
|
||||
- [ ] Routing table added (`grep proxy /etc/iproute2/rt_tables`)
|
||||
- [ ] All configs in place
|
||||
- [ ] Services enabled (not yet started)
|
||||
|
||||
## Post-Configuration Tests (After Key Exchange)
|
||||
|
||||
### DE VDS
|
||||
|
||||
- [ ] wg0.conf contains RU public key (no `__RU_DE_TUNNEL_PUBLIC_KEY__` placeholder)
|
||||
- [ ] nftables service started (`systemctl status nftables`)
|
||||
- [ ] wg-quick@wg0 started (`systemctl status wg-quick@wg0`)
|
||||
- [ ] wg0 interface exists (`ip addr show wg0`)
|
||||
- [ ] wg0 has correct IP (`ip addr show wg0 | grep 10.20.0.2`)
|
||||
|
||||
### RU VDS
|
||||
|
||||
- [ ] wg1.conf contains DE public key (no `__DE_SERVER_PUBLIC_KEY__` placeholder)
|
||||
- [ ] dnsmasq started (`systemctl status dnsmasq`)
|
||||
- [ ] wg-quick@wg1 started (`systemctl status wg-quick@wg1`)
|
||||
- [ ] wg-quick@wg0 started (`systemctl status wg-quick@wg0`)
|
||||
- [ ] wg1 interface exists (`ip addr show wg1`)
|
||||
- [ ] wg0 interface exists (`ip addr show wg0`)
|
||||
- [ ] wg1 has correct IP (`ip addr show wg1 | grep 10.20.0.1`)
|
||||
- [ ] wg0 has correct IP (`ip addr show wg0 | grep 10.10.0.1`)
|
||||
|
||||
## Tunnel Tests
|
||||
|
||||
### From RU VDS
|
||||
|
||||
- [ ] Can ping DE VDS: `ping -c 4 10.20.0.2`
|
||||
- [ ] WireGuard handshake established: `wg show wg1 | grep "latest handshake"`
|
||||
- [ ] Transfer counters incrementing: `wg show wg1 | grep transfer`
|
||||
|
||||
### From DE VDS
|
||||
|
||||
- [ ] WireGuard handshake established: `wg show wg0 | grep "latest handshake"`
|
||||
- [ ] Shows RU VDS as peer: `wg show wg0 peers`
|
||||
- [ ] Transfer counters incrementing: `wg show wg0 | grep transfer`
|
||||
|
||||
## Routing Tests (Before Client Connection)
|
||||
|
||||
### RU VDS
|
||||
|
||||
- [ ] Proxy routing table exists: `ip route show table proxy`
|
||||
- [ ] Default route via DE: `ip route show table proxy | grep "default via 10.20.0.2"`
|
||||
- [ ] Policy routing rule exists: `ip rule show | grep proxy`
|
||||
- [ ] ipset 'direct' exists: `ipset list direct`
|
||||
- [ ] iptables mangle rule exists: `iptables -t mangle -L PREROUTING | grep direct`
|
||||
|
||||
## Client Connection Tests
|
||||
|
||||
### First Client Addition
|
||||
|
||||
- [ ] Client added successfully: `/root/add-client.sh testclient`
|
||||
- [ ] Client keys generated: `ls /etc/wireguard/keys/client_testclient.*`
|
||||
- [ ] Client config created: `ls /etc/wireguard/clients/testclient.conf`
|
||||
- [ ] QR code generated successfully
|
||||
- [ ] Peer added to wg0: `wg show wg0 peers | grep -f /etc/wireguard/keys/client_testclient.pub`
|
||||
|
||||
### Client Connection (From Client Device)
|
||||
|
||||
- [ ] WireGuard app installed
|
||||
- [ ] Config imported successfully
|
||||
- [ ] Connection established
|
||||
- [ ] No connection errors in app
|
||||
|
||||
### Basic Connectivity (From Client)
|
||||
|
||||
- [ ] Can ping VPN gateway: `ping 10.10.0.1`
|
||||
- [ ] Can ping DE VDS: `ping 10.20.0.2`
|
||||
- [ ] DNS resolution works: `nslookup google.com`
|
||||
- [ ] DNS uses correct server: `nslookup google.com 10.10.0.1`
|
||||
|
||||
### Routing Verification (From Client)
|
||||
|
||||
- [ ] External IP shows DE VDS: `curl ifconfig.me` (should be 194.31.173.178)
|
||||
- [ ] Can access international sites: `curl -I https://google.com`
|
||||
- [ ] Can access Russian sites: `curl -I https://yandex.ru`
|
||||
|
||||
### DNS-Based Routing (From Client)
|
||||
|
||||
Visit some Russian sites first, then check on RU VDS:
|
||||
|
||||
- [ ] Visit `https://yandex.ru` from client
|
||||
- [ ] Visit `https://mail.ru` from client
|
||||
- [ ] Check ipset on RU VDS: `ipset list direct`
|
||||
- [ ] ipset contains Russian IPs
|
||||
- [ ] Visit `https://google.com` from client
|
||||
- [ ] Check that google IPs NOT in direct ipset
|
||||
|
||||
### Advanced Routing Tests
|
||||
|
||||
From client, check routing paths:
|
||||
|
||||
- [ ] Traceroute to Russian site shows no DE hop
|
||||
```bash
|
||||
traceroute yandex.ru
|
||||
# Should NOT show 10.20.0.x
|
||||
```
|
||||
|
||||
- [ ] Traceroute to international site shows DE hop
|
||||
```bash
|
||||
traceroute google.com
|
||||
# Should show 10.20.0.x in path
|
||||
```
|
||||
|
||||
## Performance Tests
|
||||
|
||||
### Latency (From Client)
|
||||
|
||||
- [ ] Latency to VPN gateway: `ping -c 10 10.10.0.1`
|
||||
- Expected: < 50ms (depends on your location)
|
||||
- [ ] Latency through tunnel: `ping -c 10 8.8.8.8`
|
||||
- Expected: 50-150ms (via DE)
|
||||
|
||||
### Bandwidth (From Client)
|
||||
|
||||
- [ ] Download speed test: `curl -o /dev/null https://speed.cloudflare.com/__down?bytes=100000000`
|
||||
- [ ] Should get reasonable speeds (depends on VDS specs)
|
||||
|
||||
## Client Management Tests
|
||||
|
||||
### List Clients
|
||||
|
||||
- [ ] List shows active client: `/root/list-clients.sh`
|
||||
- [ ] Shows correct IP assignment
|
||||
- [ ] Shows latest handshake
|
||||
|
||||
### Disable Client
|
||||
|
||||
- [ ] Disable client: `/root/disable-client.sh testclient`
|
||||
- [ ] Client no longer in wg show: `wg show wg0 peers`
|
||||
- [ ] Client cannot connect
|
||||
- [ ] Keys still exist: `ls /etc/wireguard/keys/client_testclient.*`
|
||||
|
||||
### Enable Client
|
||||
|
||||
- [ ] Enable client: `/root/enable-client.sh testclient`
|
||||
- [ ] Client appears in wg show: `wg show wg0 peers`
|
||||
- [ ] Client can connect again
|
||||
|
||||
### Add Multiple Clients
|
||||
|
||||
- [ ] Add 2nd client: `/root/add-client.sh client2`
|
||||
- [ ] Gets different IP (10.10.0.3)
|
||||
- [ ] Both clients can connect simultaneously
|
||||
- [ ] Both clients in list: `/root/list-clients.sh`
|
||||
|
||||
### Remove Client
|
||||
|
||||
- [ ] Remove client: `/root/remove-client.sh testclient`
|
||||
- [ ] Client not in wg show
|
||||
- [ ] Keys deleted: `ls /etc/wireguard/keys/client_testclient.* 2>&1 | grep "No such file"`
|
||||
- [ ] Config deleted: `ls /etc/wireguard/clients/testclient.conf 2>&1 | grep "No such file"`
|
||||
|
||||
## Stress Tests
|
||||
|
||||
### Multiple Concurrent Clients
|
||||
|
||||
- [ ] Add 5 clients
|
||||
- [ ] All connect simultaneously
|
||||
- [ ] All can browse internet
|
||||
- [ ] Check server load: `top` (CPU should be low)
|
||||
- [ ] Check memory: `free -h` (should have free memory)
|
||||
|
||||
### Continuous Traffic
|
||||
|
||||
- [ ] Stream video through VPN for 10 minutes
|
||||
- [ ] No disconnections
|
||||
- [ ] Stable speed
|
||||
- [ ] Check for errors: `journalctl -u wg-quick@wg0 -n 50`
|
||||
|
||||
## Security Tests
|
||||
|
||||
### Firewall Rules (DE VDS)
|
||||
|
||||
- [ ] Port 51821 only accepts from RU IP:
|
||||
```bash
|
||||
# From another host (should fail)
|
||||
nc -u 194.31.173.178 51821
|
||||
```
|
||||
|
||||
- [ ] SSH still accessible (if configured)
|
||||
- [ ] Other ports closed
|
||||
|
||||
### Firewall Rules (RU VDS)
|
||||
|
||||
- [ ] Port 51820 accepts WireGuard connections
|
||||
- [ ] DNS only from VPN clients:
|
||||
```bash
|
||||
# From outside (should fail)
|
||||
dig @176.124.216.197 google.com
|
||||
```
|
||||
|
||||
- [ ] SSH still accessible
|
||||
- [ ] Other ports closed
|
||||
|
||||
### DNS Leak Test (From Client)
|
||||
|
||||
- [ ] Check DNS server used: visit https://dnsleaktest.com/
|
||||
- [ ] Should show RU VDS or your VPN as DNS server
|
||||
- [ ] Should NOT show your ISP's DNS
|
||||
|
||||
## Failure Recovery Tests
|
||||
|
||||
### Restart Services
|
||||
|
||||
- [ ] Restart wg-quick@wg0 on RU VDS
|
||||
- [ ] Clients reconnect automatically
|
||||
- [ ] No connection loss > 30 seconds
|
||||
|
||||
### Reboot Tests
|
||||
|
||||
- [ ] Reboot DE VDS: `reboot`
|
||||
- [ ] Services auto-start after boot
|
||||
- [ ] Tunnel re-establishes
|
||||
|
||||
- [ ] Reboot RU VDS: `reboot`
|
||||
- [ ] Services auto-start after boot
|
||||
- [ ] Clients can reconnect
|
||||
|
||||
## Logs Check
|
||||
|
||||
### No Errors in Logs
|
||||
|
||||
- [ ] DE VDS WireGuard: `journalctl -u wg-quick@wg0 -n 50 --no-pager`
|
||||
- [ ] RU VDS WireGuard wg0: `journalctl -u wg-quick@wg0 -n 50 --no-pager`
|
||||
- [ ] RU VDS WireGuard wg1: `journalctl -u wg-quick@wg1 -n 50 --no-pager`
|
||||
- [ ] RU VDS dnsmasq: `journalctl -u dnsmasq -n 50 --no-pager`
|
||||
|
||||
## Final Verification
|
||||
|
||||
- [ ] All clients can connect
|
||||
- [ ] Russian domains route directly (fast)
|
||||
- [ ] International domains route through DE (working)
|
||||
- [ ] DNS resolution working
|
||||
- [ ] No errors in logs
|
||||
- [ ] Services set to auto-start
|
||||
- [ ] Documentation updated with actual client names
|
||||
- [ ] Backup of /etc/wireguard/ created
|
||||
|
||||
## Troubleshooting References
|
||||
|
||||
If any tests fail, refer to:
|
||||
- [DEPLOYMENT.md](DEPLOYMENT.md) - Troubleshooting section
|
||||
- [IMPLEMENTATION.md](IMPLEMENTATION.md) - Detailed implementation steps
|
||||
|
||||
## Test Results Template
|
||||
|
||||
```
|
||||
Date: ____________________
|
||||
Tester: __________________
|
||||
|
||||
Pre-Deployment: ☐ Pass ☐ Fail
|
||||
Post-Setup: ☐ Pass ☐ Fail
|
||||
Tunnel Tests: ☐ Pass ☐ Fail
|
||||
Routing Tests: ☐ Pass ☐ Fail
|
||||
Client Tests: ☐ Pass ☐ Fail
|
||||
Performance: ☐ Pass ☐ Fail
|
||||
Security: ☐ Pass ☐ Fail
|
||||
Recovery: ☐ Pass ☐ Fail
|
||||
|
||||
Notes:
|
||||
_____________________________________
|
||||
_____________________________________
|
||||
_____________________________________
|
||||
```
|
||||
10
configs/client-templates/example-client.conf
Normal file
10
configs/client-templates/example-client.conf
Normal file
@@ -0,0 +1,10 @@
|
||||
[Interface]
|
||||
PrivateKey = <CLIENT_PRIVATE_KEY>
|
||||
Address = 10.10.0.X/32
|
||||
DNS = 10.10.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = <RU_SERVER_PUBLIC_KEY>
|
||||
Endpoint = 176.124.216.197:51820
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
PersistentKeepalive = 25
|
||||
2
configs/de-vds/99-vpn.conf
Normal file
2
configs/de-vds/99-vpn.conf
Normal file
@@ -0,0 +1,2 @@
|
||||
# Enable IP forwarding for VPN
|
||||
net.ipv4.ip_forward = 1
|
||||
47
configs/de-vds/nftables.conf
Normal file
47
configs/de-vds/nftables.conf
Normal file
@@ -0,0 +1,47 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
|
||||
# Allow loopback
|
||||
iif lo accept
|
||||
|
||||
# Allow SSH (adjust port if needed)
|
||||
tcp dport 22 accept
|
||||
|
||||
# Allow WireGuard from RU VDS only
|
||||
ip saddr 176.124.216.197 udp dport 51821 accept
|
||||
|
||||
# Allow ICMP
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
# Allow forwarding from VPN
|
||||
iifname "wg0" accept
|
||||
|
||||
# Allow established connections back
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT traffic from VPN to internet
|
||||
oifname != "wg0" ip saddr { 10.10.0.0/24, 10.20.0.0/30 } masquerade
|
||||
}
|
||||
}
|
||||
11
configs/de-vds/wg0.conf
Normal file
11
configs/de-vds/wg0.conf
Normal file
@@ -0,0 +1,11 @@
|
||||
[Interface]
|
||||
Address = 10.20.0.2/30
|
||||
ListenPort = 51821
|
||||
PrivateKey = __DE_SERVER_PRIVATE_KEY__
|
||||
PostUp = nft -f /etc/nftables.conf
|
||||
PostDown = nft flush ruleset
|
||||
|
||||
[Peer]
|
||||
# RU VDS (server tunnel)
|
||||
PublicKey = __RU_DE_TUNNEL_PUBLIC_KEY__
|
||||
AllowedIPs = 10.20.0.1/32, 10.10.0.0/24
|
||||
2
configs/ru-vds/99-vpn.conf
Normal file
2
configs/ru-vds/99-vpn.conf
Normal file
@@ -0,0 +1,2 @@
|
||||
# Enable IP forwarding for VPN
|
||||
net.ipv4.ip_forward = 1
|
||||
55
configs/ru-vds/nftables.conf
Normal file
55
configs/ru-vds/nftables.conf
Normal file
@@ -0,0 +1,55 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
|
||||
# Allow loopback
|
||||
iif lo accept
|
||||
|
||||
# Allow SSH (adjust port if needed)
|
||||
tcp dport 22 accept
|
||||
|
||||
# Allow WireGuard from anywhere (user connections)
|
||||
udp dport 51820 accept
|
||||
|
||||
# Allow DNS from VPN clients only
|
||||
iifname "wg0" udp dport 53 accept
|
||||
iifname "wg0" tcp dport 53 accept
|
||||
|
||||
# Allow ICMP
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
# Allow forwarding from user VPN
|
||||
iifname "wg0" accept
|
||||
|
||||
# Allow forwarding from DE tunnel
|
||||
iifname "wg1" accept
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT direct traffic going out main interface
|
||||
# Traffic going through wg1 doesn't need NAT (DE VDS will NAT it)
|
||||
oifname != "wg0" oifname != "wg1" ip saddr 10.10.0.0/24 masquerade
|
||||
}
|
||||
}
|
||||
18
configs/ru-vds/postdown.sh
Normal file
18
configs/ru-vds/postdown.sh
Normal file
@@ -0,0 +1,18 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Remove policy routing rule
|
||||
ip rule del from 10.10.0.0/24 fwmark 0x1 table proxy priority 100 2>/dev/null || true
|
||||
|
||||
# Flush routing table
|
||||
ip route flush table proxy 2>/dev/null || true
|
||||
|
||||
# Remove iptables mangle rule
|
||||
iptables -t mangle -F PREROUTING 2>/dev/null || true
|
||||
|
||||
# Destroy ipsets
|
||||
ipset destroy direct 2>/dev/null || true
|
||||
|
||||
# Flush nftables (if not managed by other services)
|
||||
# nft flush ruleset
|
||||
|
||||
echo "PostDown script completed"
|
||||
21
configs/ru-vds/postup.sh
Normal file
21
configs/ru-vds/postup.sh
Normal file
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Create ipsets for routing decisions
|
||||
ipset create direct hash:net -exist
|
||||
ipset flush direct
|
||||
|
||||
# Add default route via DE tunnel for 'proxy' table
|
||||
ip route add default via 10.20.0.2 dev wg1 table proxy 2>/dev/null || true
|
||||
|
||||
# Policy routing: packets with fwmark 0x1 use 'proxy' table
|
||||
ip rule add from 10.10.0.0/24 fwmark 0x1 table proxy priority 100 2>/dev/null || true
|
||||
|
||||
# Load nftables rules
|
||||
nft -f /etc/nftables.conf
|
||||
|
||||
# Mark packets NOT going to 'direct' ipset with fwmark 0x1
|
||||
# This is needed because nftables + ipset integration is complex
|
||||
iptables -t mangle -I PREROUTING -m set ! --match-set direct dst -s 10.10.0.0/24 -j MARK --set-mark 0x1
|
||||
|
||||
echo "PostUp script completed successfully"
|
||||
10
configs/ru-vds/rt_tables
Normal file
10
configs/ru-vds/rt_tables
Normal file
@@ -0,0 +1,10 @@
|
||||
# Reserved values
|
||||
#
|
||||
255 local
|
||||
254 main
|
||||
253 default
|
||||
0 unspec
|
||||
#
|
||||
# Local routing tables
|
||||
#
|
||||
200 proxy
|
||||
30
configs/ru-vds/vpn-routing.conf
Normal file
30
configs/ru-vds/vpn-routing.conf
Normal file
@@ -0,0 +1,30 @@
|
||||
# Listen only on VPN interface
|
||||
interface=wg0
|
||||
bind-interfaces
|
||||
|
||||
# Upstream DNS servers
|
||||
server=8.8.8.8
|
||||
server=8.8.4.4
|
||||
server=1.1.1.1
|
||||
|
||||
# Don't read /etc/resolv.conf
|
||||
no-resolv
|
||||
|
||||
# Cache settings
|
||||
cache-size=10000
|
||||
|
||||
# Log queries (optional, comment out in production for performance)
|
||||
# log-queries
|
||||
|
||||
# Russian TLDs - add resolved IPs to 'direct' ipset
|
||||
# These domains will be routed directly, not through DE VDS
|
||||
ipset=/ru/direct
|
||||
ipset=/рф/direct
|
||||
ipset=/su/direct
|
||||
|
||||
# Additional Russian domains (optional, can be extended)
|
||||
# ipset=/yandex.ru/direct
|
||||
# ipset=/mail.ru/direct
|
||||
# ipset=/vk.com/direct
|
||||
|
||||
# All other domains will go through proxy (default routing)
|
||||
9
configs/ru-vds/wg0.conf
Normal file
9
configs/ru-vds/wg0.conf
Normal file
@@ -0,0 +1,9 @@
|
||||
[Interface]
|
||||
Address = 10.10.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = __RU_SERVER_PRIVATE_KEY__
|
||||
PostUp = /etc/wireguard/postup.sh
|
||||
PostDown = /etc/wireguard/postdown.sh
|
||||
|
||||
# Client peers will be added below
|
||||
# Use scripts/add-client.sh to add new clients
|
||||
10
configs/ru-vds/wg1.conf
Normal file
10
configs/ru-vds/wg1.conf
Normal file
@@ -0,0 +1,10 @@
|
||||
[Interface]
|
||||
Address = 10.20.0.1/30
|
||||
PrivateKey = __RU_DE_TUNNEL_PRIVATE_KEY__
|
||||
|
||||
[Peer]
|
||||
# DE VDS (exit node)
|
||||
PublicKey = __DE_SERVER_PUBLIC_KEY__
|
||||
Endpoint = 194.31.173.178:51821
|
||||
AllowedIPs = 10.10.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
97
scripts/add-client.sh
Executable file
97
scripts/add-client.sh
Executable file
@@ -0,0 +1,97 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Script to add a new VPN client
|
||||
# Usage: ./add-client.sh <client_name>
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: $0 <client_name>"
|
||||
echo "Example: $0 phone"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_NAME="$1"
|
||||
KEYS_DIR="/etc/wireguard/keys"
|
||||
CLIENTS_DIR="/etc/wireguard/clients"
|
||||
WG_INTERFACE="wg0"
|
||||
|
||||
# Check if client already exists
|
||||
if [ -f "${KEYS_DIR}/client_${CLIENT_NAME}.key" ]; then
|
||||
echo "ERROR: Client '${CLIENT_NAME}' already exists"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Adding new VPN client: ${CLIENT_NAME}"
|
||||
echo ""
|
||||
|
||||
# Find next available IP
|
||||
USED_IPS=$(wg show ${WG_INTERFACE} allowed-ips 2>/dev/null | grep -oP '10\.10\.0\.\K[0-9]+' | sort -n)
|
||||
NEXT_IP=2
|
||||
for ip in $USED_IPS; do
|
||||
if [ $ip -ge $NEXT_IP ]; then
|
||||
NEXT_IP=$((ip + 1))
|
||||
fi
|
||||
done
|
||||
|
||||
if [ $NEXT_IP -gt 254 ]; then
|
||||
echo "ERROR: No available IPs in 10.10.0.0/24 range"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_IP="10.10.0.${NEXT_IP}"
|
||||
|
||||
echo "[1/5] Generating client keys..."
|
||||
wg genkey | tee "${KEYS_DIR}/client_${CLIENT_NAME}.key" | wg pubkey > "${KEYS_DIR}/client_${CLIENT_NAME}.pub"
|
||||
chmod 600 "${KEYS_DIR}/client_${CLIENT_NAME}."*
|
||||
|
||||
CLIENT_PRIVATE_KEY=$(cat "${KEYS_DIR}/client_${CLIENT_NAME}.key")
|
||||
CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/client_${CLIENT_NAME}.pub")
|
||||
SERVER_PUBLIC_KEY=$(cat "${KEYS_DIR}/server.pub")
|
||||
|
||||
echo "[2/5] Adding peer to WireGuard interface..."
|
||||
wg set ${WG_INTERFACE} peer ${CLIENT_PUBLIC_KEY} allowed-ips ${CLIENT_IP}/32
|
||||
|
||||
echo "[3/5] Saving WireGuard configuration..."
|
||||
wg-quick save ${WG_INTERFACE}
|
||||
|
||||
echo "[4/5] Creating client configuration file..."
|
||||
mkdir -p ${CLIENTS_DIR}
|
||||
|
||||
cat > "${CLIENTS_DIR}/${CLIENT_NAME}.conf" << EOF
|
||||
[Interface]
|
||||
PrivateKey = ${CLIENT_PRIVATE_KEY}
|
||||
Address = ${CLIENT_IP}/32
|
||||
DNS = 10.10.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = ${SERVER_PUBLIC_KEY}
|
||||
Endpoint = 176.124.216.197:51820
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
chmod 600 "${CLIENTS_DIR}/${CLIENT_NAME}.conf"
|
||||
|
||||
echo "[5/5] Generating QR code..."
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Client added successfully!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
echo "Client name: ${CLIENT_NAME}"
|
||||
echo "Client IP: ${CLIENT_IP}"
|
||||
echo ""
|
||||
echo "Configuration file: ${CLIENTS_DIR}/${CLIENT_NAME}.conf"
|
||||
echo ""
|
||||
echo "QR Code (scan with WireGuard mobile app):"
|
||||
echo ""
|
||||
qrencode -t ansiutf8 < "${CLIENTS_DIR}/${CLIENT_NAME}.conf"
|
||||
echo ""
|
||||
echo "Or copy the configuration from:"
|
||||
echo " cat ${CLIENTS_DIR}/${CLIENT_NAME}.conf"
|
||||
echo ""
|
||||
53
scripts/disable-client.sh
Executable file
53
scripts/disable-client.sh
Executable file
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Script to disable a VPN client (keeps keys but removes from WireGuard)
|
||||
# Usage: ./disable-client.sh <client_name>
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: $0 <client_name>"
|
||||
echo "Example: $0 phone"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_NAME="$1"
|
||||
KEYS_DIR="/etc/wireguard/keys"
|
||||
WG_INTERFACE="wg0"
|
||||
|
||||
# Check if client exists
|
||||
if [ ! -f "${KEYS_DIR}/client_${CLIENT_NAME}.pub" ]; then
|
||||
echo "ERROR: Client '${CLIENT_NAME}' does not exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/client_${CLIENT_NAME}.pub")
|
||||
|
||||
# Check if client is currently active
|
||||
if ! wg show ${WG_INTERFACE} | grep -q "${CLIENT_PUBLIC_KEY}"; then
|
||||
echo "Client '${CLIENT_NAME}' is already disabled"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Disabling VPN client: ${CLIENT_NAME}"
|
||||
echo ""
|
||||
|
||||
echo "[1/2] Removing peer from WireGuard interface..."
|
||||
wg set ${WG_INTERFACE} peer ${CLIENT_PUBLIC_KEY} remove
|
||||
|
||||
echo "[2/2] Saving WireGuard configuration..."
|
||||
wg-quick save ${WG_INTERFACE}
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Client disabled successfully!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
echo "Client '${CLIENT_NAME}' is now disabled"
|
||||
echo "Keys and configuration are preserved"
|
||||
echo "To re-enable, use: ./enable-client.sh ${CLIENT_NAME}"
|
||||
echo ""
|
||||
66
scripts/enable-client.sh
Executable file
66
scripts/enable-client.sh
Executable file
@@ -0,0 +1,66 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Script to enable a previously disabled VPN client
|
||||
# Usage: ./enable-client.sh <client_name>
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: $0 <client_name>"
|
||||
echo "Example: $0 phone"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_NAME="$1"
|
||||
KEYS_DIR="/etc/wireguard/keys"
|
||||
CLIENTS_DIR="/etc/wireguard/clients"
|
||||
WG_INTERFACE="wg0"
|
||||
|
||||
# Check if client exists
|
||||
if [ ! -f "${KEYS_DIR}/client_${CLIENT_NAME}.pub" ]; then
|
||||
echo "ERROR: Client '${CLIENT_NAME}' does not exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "${CLIENTS_DIR}/${CLIENT_NAME}.conf" ]; then
|
||||
echo "ERROR: Client configuration file not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/client_${CLIENT_NAME}.pub")
|
||||
|
||||
# Check if client is already active
|
||||
if wg show ${WG_INTERFACE} | grep -q "${CLIENT_PUBLIC_KEY}"; then
|
||||
echo "Client '${CLIENT_NAME}' is already enabled"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Extract IP from client config
|
||||
CLIENT_IP=$(grep "^Address" "${CLIENTS_DIR}/${CLIENT_NAME}.conf" | awk '{print $3}')
|
||||
|
||||
if [ -z "${CLIENT_IP}" ]; then
|
||||
echo "ERROR: Could not determine client IP from config"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Enabling VPN client: ${CLIENT_NAME}"
|
||||
echo ""
|
||||
|
||||
echo "[1/2] Adding peer to WireGuard interface..."
|
||||
wg set ${WG_INTERFACE} peer ${CLIENT_PUBLIC_KEY} allowed-ips ${CLIENT_IP}
|
||||
|
||||
echo "[2/2] Saving WireGuard configuration..."
|
||||
wg-quick save ${WG_INTERFACE}
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Client enabled successfully!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
echo "Client '${CLIENT_NAME}' is now active"
|
||||
echo "IP Address: ${CLIENT_IP}"
|
||||
echo ""
|
||||
68
scripts/list-clients.sh
Executable file
68
scripts/list-clients.sh
Executable file
@@ -0,0 +1,68 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Script to list all VPN clients and their status
|
||||
# Usage: ./list-clients.sh
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WG_INTERFACE="wg0"
|
||||
KEYS_DIR="/etc/wireguard/keys"
|
||||
|
||||
echo "========================================="
|
||||
echo "VPN Clients Status"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Check if interface is up
|
||||
if ! ip link show ${WG_INTERFACE} &>/dev/null; then
|
||||
echo "ERROR: ${WG_INTERFACE} interface is not up"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Get list of client keys
|
||||
CLIENT_KEYS=$(ls ${KEYS_DIR}/client_*.pub 2>/dev/null | sed 's|.*/client_||; s|\.pub$||')
|
||||
|
||||
if [ -z "${CLIENT_KEYS}" ]; then
|
||||
echo "No clients configured"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Table header
|
||||
printf "%-15s %-15s %-45s %-20s %s\n" "Client" "IP Address" "Public Key" "Latest Handshake" "Transfer"
|
||||
echo "---------------------------------------------------------------------------------------------------------------------------"
|
||||
|
||||
for client in ${CLIENT_KEYS}; do
|
||||
CLIENT_PUBKEY=$(cat "${KEYS_DIR}/client_${client}.pub")
|
||||
|
||||
# Get client info from wg show
|
||||
CLIENT_INFO=$(wg show ${WG_INTERFACE} | grep -A 5 "${CLIENT_PUBKEY}" || echo "")
|
||||
|
||||
if [ -z "${CLIENT_INFO}" ]; then
|
||||
# Client key exists but not in wg config (disabled)
|
||||
printf "%-15s %-15s %-45s %-20s %s\n" "${client}" "N/A" "${CLIENT_PUBKEY:0:40}..." "DISABLED" "N/A"
|
||||
else
|
||||
# Extract details
|
||||
ALLOWED_IP=$(echo "${CLIENT_INFO}" | grep "allowed ips:" | awk '{print $3}' | cut -d'/' -f1)
|
||||
HANDSHAKE=$(echo "${CLIENT_INFO}" | grep "latest handshake:" | cut -d':' -f2- | xargs)
|
||||
TRANSFER=$(echo "${CLIENT_INFO}" | grep "transfer:" | cut -d':' -f2- | xargs)
|
||||
|
||||
# Format handshake
|
||||
if [ -z "${HANDSHAKE}" ]; then
|
||||
HANDSHAKE="Never"
|
||||
fi
|
||||
|
||||
# Format transfer
|
||||
if [ -z "${TRANSFER}" ]; then
|
||||
TRANSFER="N/A"
|
||||
fi
|
||||
|
||||
printf "%-15s %-15s %-45s %-20s %s\n" "${client}" "${ALLOWED_IP}" "${CLIENT_PUBKEY:0:40}..." "${HANDSHAKE}" "${TRANSFER}"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Total clients: $(echo "${CLIENT_KEYS}" | wc -w)"
|
||||
echo ""
|
||||
51
scripts/remove-client.sh
Executable file
51
scripts/remove-client.sh
Executable file
@@ -0,0 +1,51 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Script to remove a VPN client
|
||||
# Usage: ./remove-client.sh <client_name>
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: $0 <client_name>"
|
||||
echo "Example: $0 phone"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_NAME="$1"
|
||||
KEYS_DIR="/etc/wireguard/keys"
|
||||
CLIENTS_DIR="/etc/wireguard/clients"
|
||||
WG_INTERFACE="wg0"
|
||||
|
||||
# Check if client exists
|
||||
if [ ! -f "${KEYS_DIR}/client_${CLIENT_NAME}.pub" ]; then
|
||||
echo "ERROR: Client '${CLIENT_NAME}' does not exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/client_${CLIENT_NAME}.pub")
|
||||
|
||||
echo "Removing VPN client: ${CLIENT_NAME}"
|
||||
echo ""
|
||||
|
||||
echo "[1/4] Removing peer from WireGuard interface..."
|
||||
wg set ${WG_INTERFACE} peer ${CLIENT_PUBLIC_KEY} remove
|
||||
|
||||
echo "[2/4] Saving WireGuard configuration..."
|
||||
wg-quick save ${WG_INTERFACE}
|
||||
|
||||
echo "[3/4] Removing client keys..."
|
||||
rm -f "${KEYS_DIR}/client_${CLIENT_NAME}.key"
|
||||
rm -f "${KEYS_DIR}/client_${CLIENT_NAME}.pub"
|
||||
|
||||
echo "[4/4] Removing client configuration..."
|
||||
rm -f "${CLIENTS_DIR}/${CLIENT_NAME}.conf"
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Client removed successfully!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
137
scripts/setup-de-vds.sh
Executable file
137
scripts/setup-de-vds.sh
Executable file
@@ -0,0 +1,137 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Setup script for DE VDS (Exit Node)
|
||||
# Run this script as root on the DE VDS server
|
||||
|
||||
echo "========================================="
|
||||
echo "DE VDS (Exit Node) Setup"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Check if running as root
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[1/7] Updating system packages..."
|
||||
apt update
|
||||
apt upgrade -y
|
||||
|
||||
echo "[2/7] Installing required packages..."
|
||||
apt install -y wireguard nftables iptables
|
||||
|
||||
echo "[3/7] Enabling IP forwarding..."
|
||||
cat > /etc/sysctl.d/99-vpn.conf << 'EOF'
|
||||
# Enable IP forwarding for VPN
|
||||
net.ipv4.ip_forward = 1
|
||||
EOF
|
||||
sysctl -p /etc/sysctl.d/99-vpn.conf
|
||||
|
||||
echo "[4/7] Generating WireGuard keys..."
|
||||
mkdir -p /etc/wireguard/keys
|
||||
chmod 700 /etc/wireguard/keys
|
||||
wg genkey | tee /etc/wireguard/keys/server.key | wg pubkey > /etc/wireguard/keys/server.pub
|
||||
chmod 600 /etc/wireguard/keys/*
|
||||
|
||||
echo "[5/7] Creating WireGuard configuration..."
|
||||
cat > /etc/wireguard/wg0.conf << 'EOF'
|
||||
[Interface]
|
||||
Address = 10.20.0.2/30
|
||||
ListenPort = 51821
|
||||
PrivateKey = __DE_SERVER_PRIVATE_KEY__
|
||||
PostUp = nft -f /etc/nftables.conf
|
||||
PostDown = nft flush ruleset
|
||||
|
||||
[Peer]
|
||||
# RU VDS (server tunnel)
|
||||
PublicKey = __RU_DE_TUNNEL_PUBLIC_KEY__
|
||||
AllowedIPs = 10.20.0.1/32, 10.10.0.0/24
|
||||
EOF
|
||||
|
||||
# Replace private key placeholder
|
||||
PRIVATE_KEY=$(cat /etc/wireguard/keys/server.key)
|
||||
sed -i "s|__DE_SERVER_PRIVATE_KEY__|${PRIVATE_KEY}|g" /etc/wireguard/wg0.conf
|
||||
|
||||
echo "[6/7] Creating nftables configuration..."
|
||||
cat > /etc/nftables.conf << 'EOF'
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
|
||||
# Allow loopback
|
||||
iif lo accept
|
||||
|
||||
# Allow SSH (adjust port if needed)
|
||||
tcp dport 22 accept
|
||||
|
||||
# Allow WireGuard from RU VDS only
|
||||
ip saddr 176.124.216.197 udp dport 51821 accept
|
||||
|
||||
# Allow ICMP
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
# Allow forwarding from VPN
|
||||
iifname "wg0" accept
|
||||
|
||||
# Allow established connections back
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT traffic from VPN to internet
|
||||
oifname != "wg0" ip saddr { 10.10.0.0/24, 10.20.0.0/30 } masquerade
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
chmod +x /etc/nftables.conf
|
||||
|
||||
echo "[7/7] Enabling services..."
|
||||
systemctl enable nftables
|
||||
systemctl enable wg-quick@wg0
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Setup completed!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
echo "IMPORTANT: Next steps"
|
||||
echo ""
|
||||
echo "1. Your DE VDS public key is:"
|
||||
echo ""
|
||||
cat /etc/wireguard/keys/server.pub
|
||||
echo ""
|
||||
echo "2. You need to get the RU VDS public key (from de-tunnel.pub)"
|
||||
echo ""
|
||||
echo "3. Edit /etc/wireguard/wg0.conf and replace:"
|
||||
echo " __RU_DE_TUNNEL_PUBLIC_KEY__ with the actual RU VDS de-tunnel public key"
|
||||
echo ""
|
||||
echo "4. Start the services:"
|
||||
echo " systemctl start nftables"
|
||||
echo " systemctl start wg-quick@wg0"
|
||||
echo ""
|
||||
echo "5. Verify the tunnel:"
|
||||
echo " wg show"
|
||||
echo " ping 10.20.0.1"
|
||||
echo ""
|
||||
261
scripts/setup-ru-vds.sh
Executable file
261
scripts/setup-ru-vds.sh
Executable file
@@ -0,0 +1,261 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Setup script for RU VDS (Gateway)
|
||||
# Run this script as root on the RU VDS server
|
||||
|
||||
echo "========================================="
|
||||
echo "RU VDS (Gateway) Setup"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Check if running as root
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[1/10] Updating system packages..."
|
||||
apt update
|
||||
apt upgrade -y
|
||||
|
||||
echo "[2/10] Installing required packages..."
|
||||
apt install -y wireguard dnsmasq nftables iptables ipset qrencode
|
||||
|
||||
echo "[3/10] Disabling systemd-resolved (conflicts with dnsmasq)..."
|
||||
systemctl disable --now systemd-resolved 2>/dev/null || true
|
||||
rm -f /etc/resolv.conf
|
||||
cat > /etc/resolv.conf << 'EOF'
|
||||
nameserver 8.8.8.8
|
||||
nameserver 1.1.1.1
|
||||
EOF
|
||||
|
||||
echo "[4/10] Enabling IP forwarding..."
|
||||
cat > /etc/sysctl.d/99-vpn.conf << 'EOF'
|
||||
# Enable IP forwarding for VPN
|
||||
net.ipv4.ip_forward = 1
|
||||
EOF
|
||||
sysctl -p /etc/sysctl.d/99-vpn.conf
|
||||
|
||||
echo "[5/10] Generating WireGuard keys..."
|
||||
mkdir -p /etc/wireguard/keys
|
||||
chmod 700 /etc/wireguard/keys
|
||||
|
||||
# Server key for user-facing interface
|
||||
wg genkey | tee /etc/wireguard/keys/server.key | wg pubkey > /etc/wireguard/keys/server.pub
|
||||
|
||||
# Key for DE tunnel
|
||||
wg genkey | tee /etc/wireguard/keys/de-tunnel.key | wg pubkey > /etc/wireguard/keys/de-tunnel.pub
|
||||
|
||||
chmod 600 /etc/wireguard/keys/*
|
||||
|
||||
echo "[6/10] Adding custom routing table..."
|
||||
if ! grep -q "^200[[:space:]]*proxy" /etc/iproute2/rt_tables; then
|
||||
echo "200 proxy" >> /etc/iproute2/rt_tables
|
||||
fi
|
||||
|
||||
echo "[7/10] Creating WireGuard configurations..."
|
||||
|
||||
# wg0 - user-facing
|
||||
cat > /etc/wireguard/wg0.conf << 'EOF'
|
||||
[Interface]
|
||||
Address = 10.10.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = __RU_SERVER_PRIVATE_KEY__
|
||||
PostUp = /etc/wireguard/postup.sh
|
||||
PostDown = /etc/wireguard/postdown.sh
|
||||
|
||||
# Client peers will be added below
|
||||
# Use add-client.sh script to add new clients
|
||||
EOF
|
||||
|
||||
# Replace private key placeholder
|
||||
PRIVATE_KEY=$(cat /etc/wireguard/keys/server.key)
|
||||
sed -i "s|__RU_SERVER_PRIVATE_KEY__|${PRIVATE_KEY}|g" /etc/wireguard/wg0.conf
|
||||
|
||||
# wg1 - DE tunnel
|
||||
cat > /etc/wireguard/wg1.conf << 'EOF'
|
||||
[Interface]
|
||||
Address = 10.20.0.1/30
|
||||
PrivateKey = __RU_DE_TUNNEL_PRIVATE_KEY__
|
||||
|
||||
[Peer]
|
||||
# DE VDS (exit node)
|
||||
PublicKey = __DE_SERVER_PUBLIC_KEY__
|
||||
Endpoint = 194.31.173.178:51821
|
||||
AllowedIPs = 10.10.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
# Replace private key placeholder
|
||||
DE_TUNNEL_KEY=$(cat /etc/wireguard/keys/de-tunnel.key)
|
||||
sed -i "s|__RU_DE_TUNNEL_PRIVATE_KEY__|${DE_TUNNEL_KEY}|g" /etc/wireguard/wg1.conf
|
||||
|
||||
echo "[8/10] Creating WireGuard helper scripts..."
|
||||
|
||||
# PostUp script
|
||||
cat > /etc/wireguard/postup.sh << 'EOF'
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Create ipsets for routing decisions
|
||||
ipset create direct hash:net -exist
|
||||
ipset flush direct
|
||||
|
||||
# Add default route via DE tunnel for 'proxy' table
|
||||
ip route add default via 10.20.0.2 dev wg1 table proxy 2>/dev/null || true
|
||||
|
||||
# Policy routing: packets with fwmark 0x1 use 'proxy' table
|
||||
ip rule add from 10.10.0.0/24 fwmark 0x1 table proxy priority 100 2>/dev/null || true
|
||||
|
||||
# Load nftables rules
|
||||
nft -f /etc/nftables.conf
|
||||
|
||||
# Mark packets NOT going to 'direct' ipset with fwmark 0x1
|
||||
iptables -t mangle -I PREROUTING -m set ! --match-set direct dst -s 10.10.0.0/24 -j MARK --set-mark 0x1
|
||||
|
||||
echo "PostUp script completed successfully"
|
||||
EOF
|
||||
|
||||
# PostDown script
|
||||
cat > /etc/wireguard/postdown.sh << 'EOF'
|
||||
#!/bin/bash
|
||||
|
||||
# Remove policy routing rule
|
||||
ip rule del from 10.10.0.0/24 fwmark 0x1 table proxy priority 100 2>/dev/null || true
|
||||
|
||||
# Flush routing table
|
||||
ip route flush table proxy 2>/dev/null || true
|
||||
|
||||
# Remove iptables mangle rule
|
||||
iptables -t mangle -F PREROUTING 2>/dev/null || true
|
||||
|
||||
# Destroy ipsets
|
||||
ipset destroy direct 2>/dev/null || true
|
||||
|
||||
echo "PostDown script completed"
|
||||
EOF
|
||||
|
||||
chmod +x /etc/wireguard/postup.sh
|
||||
chmod +x /etc/wireguard/postdown.sh
|
||||
|
||||
echo "[9/10] Creating nftables configuration..."
|
||||
cat > /etc/nftables.conf << 'EOF'
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
|
||||
# Allow loopback
|
||||
iif lo accept
|
||||
|
||||
# Allow SSH (adjust port if needed)
|
||||
tcp dport 22 accept
|
||||
|
||||
# Allow WireGuard from anywhere (user connections)
|
||||
udp dport 51820 accept
|
||||
|
||||
# Allow DNS from VPN clients only
|
||||
iifname "wg0" udp dport 53 accept
|
||||
iifname "wg0" tcp dport 53 accept
|
||||
|
||||
# Allow ICMP
|
||||
icmp type echo-request accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
# Allow forwarding from user VPN
|
||||
iifname "wg0" accept
|
||||
|
||||
# Allow forwarding from DE tunnel
|
||||
iifname "wg1" accept
|
||||
|
||||
# Allow established connections
|
||||
ct state established,related accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table inet nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100;
|
||||
|
||||
# NAT direct traffic going out main interface
|
||||
oifname != "wg0" oifname != "wg1" ip saddr 10.10.0.0/24 masquerade
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
chmod +x /etc/nftables.conf
|
||||
|
||||
echo "[10/10] Configuring dnsmasq..."
|
||||
cat > /etc/dnsmasq.d/vpn-routing.conf << 'EOF'
|
||||
# Listen only on VPN interface
|
||||
interface=wg0
|
||||
bind-interfaces
|
||||
|
||||
# Upstream DNS servers
|
||||
server=8.8.8.8
|
||||
server=8.8.4.4
|
||||
server=1.1.1.1
|
||||
|
||||
# Don't read /etc/resolv.conf
|
||||
no-resolv
|
||||
|
||||
# Cache settings
|
||||
cache-size=10000
|
||||
|
||||
# Russian TLDs - add resolved IPs to 'direct' ipset
|
||||
ipset=/ru/direct
|
||||
ipset=/рф/direct
|
||||
ipset=/su/direct
|
||||
|
||||
# All other domains will go through proxy (default routing)
|
||||
EOF
|
||||
|
||||
# Create clients directory
|
||||
mkdir -p /etc/wireguard/clients
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Setup completed!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
echo "IMPORTANT: Next steps"
|
||||
echo ""
|
||||
echo "1. Your RU VDS public keys are:"
|
||||
echo ""
|
||||
echo " Server key (for clients):"
|
||||
cat /etc/wireguard/keys/server.pub
|
||||
echo ""
|
||||
echo " DE tunnel key (for DE VDS):"
|
||||
cat /etc/wireguard/keys/de-tunnel.pub
|
||||
echo ""
|
||||
echo "2. You need to get the DE VDS public key"
|
||||
echo ""
|
||||
echo "3. Edit /etc/wireguard/wg1.conf and replace:"
|
||||
echo " __DE_SERVER_PUBLIC_KEY__ with the actual DE VDS public key"
|
||||
echo ""
|
||||
echo "4. Enable and start services:"
|
||||
echo " systemctl enable nftables dnsmasq"
|
||||
echo " systemctl start dnsmasq"
|
||||
echo " systemctl start wg-quick@wg1"
|
||||
echo " systemctl start wg-quick@wg0"
|
||||
echo ""
|
||||
echo "5. Verify the tunnel:"
|
||||
echo " wg show"
|
||||
echo " ping 10.20.0.2"
|
||||
echo ""
|
||||
echo "6. Add clients using: /root/add-client.sh <client_name>"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user